A critical vulnerability dubbed Plugin4Shell is jeopardizing the systems of software developers using AI-based programming assistants. Through manipulated extensions on marketplaces, attackers can achieve remote code execution (RCE) without any user interaction. Affected tools include Anthropic’s Claude Code, OpenAI Codex, GitHub Copilot, and Google’s Gemini CLI.
Forged Git Branches Bypass Integrity Checks
The flaw was discovered by IT security firm AIR Security back in May 2026. The issue lies in the way coding agents retrieve external extensions. By design, the tools request a 40-character SHA fingerprint from marketplaces—a cryptographic checksum intended to ensure that exactly the pre-verified version of a software package (commit) is installed.
In practice, however, the affected tools did not verify whether the code’s actual hash matched this fingerprint after downloading. Attackers with access to a plugin vendor’s repository could thus create a development branch whose name exactly mirrors the expected hash and populate it with malicious code. If this manipulated branch is made the default, the AI agent downloads and directly executes the malicious code instead of the verified version during the next automatic update.
According to the researchers, this technique works on marketplaces hosted on Bitbucket, GitLab, or self-hosted Git servers. GitHub itself blocks the creation of branch names formatted like Git hashes. There are no known instances of this vulnerability being exploited in the wild so far.
Patch Status: Anthropic and OpenAI Deliver, Copilot Remains Open
The vendors were notified of the attack vector in June 2026, though their responses have varied significantly. Anthropic resolved the vulnerability with version 2.1.179 of Claude Code. OpenAI also rolled out a fix, which has been integrated into Codex version 0.146.0 since early August.
Users of Microsoft’s GitHub Copilot, on the other hand, will have to wait longer: no patch is currently available for the tool, and the vendor has not responded to the discoverers. The vulnerability joins a series of incidents where interfaces of modern large language models pose a risk—only recently, a security incident in which Google’s Gemini escaped test environments demonstrated how delicate these agent execution environments are.
Gemini CLI Discontinued
For users of the consumer version of Google’s Gemini CLI, there is bad news: the tool will remain permanently vulnerable. Google confirmed to the security researchers that the consumer edition of the command-line tool is being discontinued and will not receive any further security updates. Enterprise access via Gemini Code Assist or Google Cloud remains unaffected by this deprecation.
Developers using Claude Code or OpenAI Codex should immediately verify that their installations are up to date. Users of the consumer version of Gemini CLI should uninstall the application and switch to alternatives such as Antigravity CLI, which does not employ a comparable SHA pinning mechanism for marketplace plugins. For GitHub Copilot, caution is advised when integrating third-party extensions until a corresponding update is released.
Sources: Heise – News
