On 17 September 2026, researchers at Air Security disclosed a shared vulnerability affecting four of the most widely used AI coding agents at once: Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI. Dubbed Plugin4Shell, it breaks the SHA-pinning mechanism developers rely on to lock an installed plugin to a specific, reviewed version of its code — and it requires no click, no approval and no reinstall to trigger. If you use any of these four tools with plugins installed, this is worth fifteen minutes today rather than a line item for next sprint.
What actually breaks
SHA pinning is supposed to guarantee that a plugin you reviewed and approved stays exactly the code you reviewed, by locking it to a specific content hash. Plugin4Shell exploits a mismatch between how Git names a commit and what content it actually points to, letting an attacker swap a plugin's contents while the SHA pin still appears to match. The attack path is patient rather than clever: publish a legitimate-looking plugin, let it gain real adoption, then modify the upstream repository — or compromise an existing plugin maintainer's account — and the swapped code ships silently.
The "zero-click" part is what makes this different from an ordinary supply-chain risk. Claude Code and Codex both update installed plugins automatically in the background by default, so a compromised plugin can reach a running installation without the developer opening the tool, approving an update, or doing anything at all. A successful exploit runs with the same reach as the developer's own account — proprietary source, API keys, CI/CD credentials and whatever cloud environments that account can touch.
The timeline, and why it matters
Air Security says it discovered the flaw in May 2026 and disclosed it to all four vendors that June under coordinated disclosure, ahead of the public write-up on 17 September. That gap between private disclosure and public reporting is normal responsible-disclosure practice — it exists to give vendors time to ship fixes before attackers learn the technique. What is unusual, and worth sitting with, is what happened during that window: two vendors fixed it, and two did not.
Where each tool actually stands
Claude Code is patched, in version 2.1.179. OpenAI Codex is patched, in version 0.146.0. If you run either tool, updating to that version or later closes this specific hole.
GitHub Copilot has not shipped a fix as of this vulnerability's public disclosure, despite being notified alongside the other three vendors. There is no patched version to move to right now, which means the mitigation has to happen at the plugin-management layer rather than the update layer — treat any Copilot plugin you did not personally vet as untrusted, and avoid enabling background auto-updates for plugins where you have that control.
Gemini CLI is in a different, arguably worse position: Google has deprecated the tool rather than patching it, and is directing users toward its newer Antigravity environment instead. Every existing Gemini CLI installation stays exposed indefinitely, because there is no vendor intention to fix the version people are actually running. If your team still has Gemini CLI installed anywhere, the realistic fix is migration, not a future patch.
What to actually do this week
First, find out which of these four tools your team — or your contractors, or anyone with commit access to your repos — actually has installed, including old installs nobody remembers setting up. Second, for Claude Code and Codex, confirm you are on 2.1.179 and 0.146.0 respectively or later; a version check takes under a minute per machine. Third, for GitHub Copilot, audit every installed plugin and remove any you cannot personally account for the provenance of, since there is no patch to lean on. Fourth, for Gemini CLI, treat continued use as an accepted, standing risk rather than a temporary gap, and put migrating off it on an actual roadmap rather than a someday list.
More generally, this is a good prompt to check whether any of your AI coding tools auto-update plugins silently by default, and to decide deliberately whether you want that convenience given what it just cost four vendors' worth of users.
The bottom line
Plugin4Shell is a zero-click flaw that let a compromised plugin quietly replace itself with attacker-controlled code across Claude Code, Codex, Copilot and Gemini CLI. Two of those four now have real fixes — update to Claude Code 2.1.179 or Codex 0.146.0 if you run either — and two do not: Copilot has no patch yet, and Gemini CLI never will. If any of the four are running anywhere in your organisation, check versions and audit plugins today, not after your next incident.