Executive Summary
Air Security's Plugin4Shell: in four AI coding agents, whoever controls a plugin's repository could swap the installed plugin for a malicious one even when pinned to a reviewed version; Claude Code 2.1.179 and Codex 0.146.0 are patched.
What Happened
A flaw in four widely used AI coding agents lets someone who controls a plugin's code repository swap the plugin an agent installs for a malicious one, even when the agent locked that plugin to a specific reviewed version, security firm Air Security said on Thursday. The firm said Anthropic has patched the flaw in Claude Code 2.1.179 and OpenAI in Codex 0.146.0, that GitHub Copilot has no
Affected Products
- Claude Code
- OpenAI Codex
- GitHub Copilot
Vulnerability / Attack Technique
Plugin substitution in AI coding agents
Technical Mechanism
As reported, version pinning did not guarantee the reviewed code was installed.
AI Security Category
LLM03:2025 Supply Chain
Part of the AI Supply Chain and AI SBOM topic.
Relevant Frameworks
RealGround Analysis
Pinning must be by content, not by label. RealGround analysis: update coding agents and review installed plugins.
Recommended Controls
- Update Claude Code and Codex
- Limit agent plugins to trusted repositories
Related RealGround Service
AI Agent SBOM and LLM Mapping · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/09/plugin4shell-lets-repository-owners.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.