NEW YORK — A security gap in AI coding agents’ plugin verification has remained unresolved at one company even after four firms were warned about it three months ago. Two shipped fixes before the issue became public, one deprecated its product instead of patching it, and one has taken no action.
Security researchers at AIR publicly disclosed the flaw Thursday, naming it Plugin4Shell. They described it as a zero-click remote-code-execution vulnerability that defeats the safeguard many developers assumed their coding tools provided: a locked and reviewed version of every installed plugin.
The technique targets SHA pinning, which lets developers lock a plugin to a specific commit hash so the tool consistently runs the code that was reviewed and approved. Every major AI coding agent that supports plugins implements SHA pinning.
But according to AIR, each checks whether the requested commit is correct—and none verifies whether the checkout actually landed on that commit.
That gap means an attacker who can push code to a plugin’s repository, through compromise, insider access, or a typosquatted package, can redirect the checkout to a malicious branch while the pin still looks honored to the agent. The exploit requires no action from the developer. It runs at plugin load time, without notification or visible change.
What AI coding agents can reach is not a small surface. Research has repeatedly shown that these tools frequently operate with access to local source code, SSH keys, cloud credentials, environment variables, internal repositories, and production deployment systems. That access is what makes them useful. It is also what makes the plugin trust model the highest-stakes assumption in the stack.
AIR’s researchers, Or Nevo, Dor Granat, and Niv Hoffman, found the bug in May 2026. They disclosed it to Anthropic, OpenAI, Microsoft, and Google in June, giving each company more than three months to respond before the Thursday publication. The flaw was independently present in all four tools: Anthropic’s Claude Code, OpenAI’s Codex, GitHub Copilot from Microsoft, and Google’s Gemini CLI. AIR’s public disclosure describes this convergence not as coincidence but as shared design logic, the same assumption built into four products by four separate teams, and never validated by any of them.
Anthropic and OpenAI patched before the disclosure date. Anthropic shipped the fix in Claude Code version 2.1.179 without naming the security fix in the public release notes; OpenAI similarly addressed it in Codex version 0.146.0. Neither company published a formal security advisory or requested a CVE identifier for the vulnerability.
Microsoft, notified in the same June disclosure, has not shipped a fix for GitHub Copilot. The company has not publicly acknowledged the flaw, provided a remediation timeline, or published a security advisory as of Saturday. GitHub Copilot is among the most widely deployed AI developer tools in the world, integrated into Visual Studio Code, the GitHub platform, and the broader Microsoft 365 ecosystem. The absence of a patch leaves developers without a clear mitigation path other than disabling all plugins entirely.
Google did not patch Gemini CLI. The company informed users that Gemini CLI is deprecated and directed them toward a product called Antigravity CLI. Every existing Gemini CLI installation remains exposed, and whether the recommended migration path closes the Plugin4Shell exposure has not been independently verified.
What separates this disclosure from a typical product bug is the universality. Four engineering teams at four companies built four different products and all implemented the same incomplete verification at the same point in the plugin loading sequence. That is not an implementation error in the ordinary sense. It is a shared assumption the industry never wrote down and therefore never tested: that requesting a specific commit and landing on that commit are the same operation.
The pattern fits what security researchers have been documenting across the AI coding agent ecosystem this year. Google’s Gemini AI accessed three real companies without authorization during a controlled security test earlier this week, in a separate but structurally similar failure: an AI tool operating at the boundary of what its designers assumed was its contained environment, reaching systems no one had decided it should reach.
No exploitation of Plugin4Shell in the wild has been reported. The gap between that absence and the actual exposure remains wide. Millions of developers using GitHub Copilot have no patch available. No CVE has been issued. No formal coordinated disclosure protocol was followed. The practical question, when the product used daily by a significant portion of the global developer community will be fixed, has no public answer.
AIR’s researchers found the same flaw in every tool they looked at. What they could not do was make two of those tools’ vendors account for it publicly.
