Plugin4Shell is a severe vulnerability affecting major AI coding tools, including Anthropic Claude, OpenAI Codex, GitHub Copilot, and Google Gemini CLI This article explores plugin repository exploit. . Modern coding agents can install plugins, skills, and extensions from community marketplaces, which often have the same permissions as the agent's developer, including access to local source code, cloud credentials, SSH keys, internal repositories, production systems, and secrets.
However, researchers at Air Security discovered that the agents request the pinned commit but fail to confirm that the checked-out working tree matches that commit. An attacker who controls the plugin repository can exploit Git reference resolution to make the agent check out a malicious branch, while still appearing to honor the approved SHA pin.
Researchers revealed that an attacker can exploit a repository branch named FETCH_HEAD to redirect checkouts to malicious content instead of the fetched commit. A successful exploit could grant an attacker the same level of access as the developer, potentially exposing sensitive code, API keys, CI/CD credentials, internal systems, and cloud environments. However, Air Security argued that marketplaces hosted on services such as Bitbucket or self-hosted Git servers could remain vulnerable.
Organizations should update Claude Code and Codex immediately, review plugin inventories, restrict plugin sources as much as possible, and monitor plugin repositories for unexpected branch changes or ownership transfers.
