A newly disclosed flaw affects how several AI coding agents retrieve plugins from source repositories.
The issue is called Plugin4Shell by Air Security, which reported it on September 17.
The affected agents named by the researchers are Claude Code, Codex, GitHub Copilot, and Gemini CLI.
The problem concerns version verification, not the reasoning ability of the models running inside those agents.

AI makes it easier to ship anything, even bad ideas. The hard part is knowing which ideas are worth building.

Jira Product Discovery brings your ideas, customer insights, and priorities into one place, so your team can decide what to ship and move forward with confidence.

Capture ideas, prioritize with evidence, and build living roadmaps your team can rally around—all while staying connected to delivery in Jira, so everyone can see what’s being built and why.

Better product decisions in the AI era.

Try Jira Product Discovery

Plugin marketplaces often identify a reviewed plugin version with a commit hash.
A commit hash is intended to point to one exact snapshot of a repository.
Air Security says the affected agents requested that hash but did not verify the code actually returned.
Under certain repository configurations, Git can interpret a hash-shaped name as a branch or tag.

That creates a gap between the version a marketplace approves and the version an agent executes.
A repository owner who controls the source could point that name toward different code.
The agent could then report that it used the pinned version while running another snapshot.
This is a supply chain problem because trust moves through the repository and marketplace together.

The risk grows when plugins update without a new user decision.
Air says background updates can replace a previously trusted plugin after the original installation.
The Hacker News reported that automatic updates are enabled by default in Claude Code and Codex.
It also reported that outside marketplaces may have different settings and exposure conditions.

Greenfield Robotics is on a mission to give farmers alternatives to herbicide-dependent weed control. BOTONY is the beginning of a broader robotic farming system designed for a wider range of applications in the field.

The Reg A+ offering is now live for investors who want to be part of what comes next.

Invest in Robots Replacing Herbicides

^{This Reg A+ offering is made available through StartEngine Primary, LLC, member FINRA/SIPC. Please read the Offering Circular and related disclosures before investing. This investment is speculative, illiquid, and involves a high degree of risk, including the possible loss of your entire investment.}

The flaw does not apply identically to every repository host.
The Hacker News reported that GitHub blocks branch and tag names that look like commit hashes.
Air says the technique can work on hosts that allow those names, including some self-hosted or alternative services.
The reported conditions therefore depend on the agent, repository host, marketplace, and update path.

The possible impact comes from the permissions of the agent process.
Air says a plugin runs with the access available to the person using the coding agent.
That can include project files, saved credentials, and systems reachable from the workstation.
The researchers disclosed a code-execution path, but they did not report a real-world attack using it.

Patch status was uneven in the reporting available on September 18.
Air said Claude Code fixed the issue in version 2.1.179 and Codex fixed it in version 0.146.0.
Air said GitHub Copilot had no fix at that time.
It also said the consumer Gemini CLI would not receive a fix because Google is retiring it.

Those status claims need careful attribution.
The Hacker News noted that the Claude release notes did not describe the fix in detail.
It also reported that enterprise Gemini CLI access would continue, although the fix status was unclear.
A version number alone therefore does not prove that an existing plugin was safe or had been replaced.

The technical lesson is simple but consequential for agent design.
A lock is useful only when the client verifies the object returned by the lock.
The check must happen on the user’s machine because that is where the agent fetches and runs code.
Marketplace review cannot compensate for an unchecked resolution step inside the client.

Teams using coding agents need an inventory of plugin sources, update behavior, and execution permissions.
They also need vendor confirmation about fixes and whether prior installations require separate review.
The public record does not yet establish a common remediation process across all four agents.
Plugin supply chains are becoming part of software security, even when the plugin is selected by an AI assistant.

The next wave of millionaires will be people who figured out how to make AI work for them.

The window to get ahead is still open. But not for long.

Here are 200+ proven ways to make money with AI in 2026.

Sign up for Superhuman AI, the free daily newsletter read by 1M+ professionals, and get instant access to all 200+ ways to profit from AI this year.

Claim your free list