Claude Code Plugin Vulnerability: Update Now

Your coding agent updates its plugins in the background, and until this week that was the boring part. On 17 September 2026 the research lab at Air Security published Plugin4Shell, and the Claude Code plugin vulnerability it describes needs no click, no prompt, and nothing you would notice. The same mistake sits in OpenAI Codex, GitHub Copilot and Gemini CLI. Two of those four have a patch. Two do not, and one of them never will.

Key Takeaways:

• Plugin4Shell defeats SHA pinning: the agent checks out the pinned commit but never confirms the checkout actually landed there, so an attacker who controls the plugin repo serves different code while the pin still reads as honored
• Background plugin auto-update, which is on by default in Claude Code and Codex, is what makes it zero-click; a plugin you installed months ago and never touched again is the delivery vehicle
• Claude Code fixed it in 2.1.179 and Codex in 0.146.0, both months before the public write-up, so anyone on a current build is already past it
• GitHub Copilot has no fix as of 18 September 2026, and Air says Google declined to patch Gemini CLI on the grounds that it is deprecated
• There is no error message to search for; the whole point of the attack is that nothing surfaces

What Plugin4Shell does to a pinned commit

Pinning is supposed to end the argument. You read a plugin's code at one commit, write that 40-character hash into the marketplace entry, and the agent installs that exact code forever after. Every review process built on community marketplaces leans on it.

Air's write-up shows the pin is checked out but never verified. Claude Code, Codex and Copilot clone the plugin repository and run git checkout <pinned-sha>; nothing afterwards asks whether the working tree is actually sitting on that commit. Git will happily resolve a name that is both a valid reference and an object id, and it prefers the reference. So an attacker who controls the upstream repo creates a branch whose name is the exact 40-hex pinned SHA, makes it the default branch, and points it at whatever they like. The clone brings the branch down, the checkout resolves to it, and the agent reports a clean install at the pinned commit. Git's only complaint is a refname is ambiguous warning that nobody reads.

Gemini CLI gets there by a slightly different route: it fetches the pinned commit correctly, then runs git checkout FETCH_HEAD, which resolves to a branch literally named FETCH_HEAD if the repository has one as its default. The correct commit sits in .git/FETCH_HEAD, unused.

The zero-click part comes from auto-update. Claude Code and Codex refresh installed plugins in the background by default, so when a marketplace bumps a pinned SHA, that same unverified checkout runs again on machines where the plugin has been sitting untouched. Nobody installs anything. Nobody approves anything.

Most plugins exist to reach a system that holds credentials, which is the uncomfortable part: a Jira plugin, a database plugin, a deploy plugin. The code runs with your permissions because that is the only way it can do its job. An assistant that connects to Jira or Slack or your inbox directly, and hands the finished piece of work back into that tool, has no stranger's git repository sitting in the middle of the path. That is the structural difference Zentor is built around, and it is why the blast radius question and the convenience question have the same answer here.

Which agents are patched, and which are still open

Air disclosed to all four vendors in June 2026, three months before going public. Here is where each one stands, taken from the disclosure timeline and checked against the vendors' own release pages on 18 September 2026:

The practical upshot for most readers is dull, which is the good news. Claude Code's current release stream sits at 2.1.275, published 17 September 2026; Codex is on 0.155.0, published the same day. If you update either tool with any regularity, this Claude Code plugin vulnerability closed itself for you back in the summer without you ever hearing about it.

Copilot is the one to think about. There is no version to move to, so the only levers are the ones you control: which plugins are installed, where they come from, and whether the agent is allowed to refresh them unattended.

One caveat, which Air states themselves: they sell Air Marketplace and Air Filter, and the disclosure notes their customers were unaffected. The git behaviour they describe is reproducible and the fixes their timeline points at are real and datable, so the technical claims stand on their own. Read past the product exemption.

The Claude Code fix shipped as an ordinary bugfix

Anthropic confirmed the fix in 2.1.179 on 17 June 2026. Pull up that release on GitHub and there is no security note, no advisory, no CVE, nothing marked out from the usual run of patches. The closest line is "Improved plugin loading performance in remote sessions," sitting ninth in a list that also covers mouse-wheel scrolling in WSL2 and a stuck spinner.

A quiet fix during an embargo is correct behaviour rather than a scandal, but it does mean version numbers are the only signal you get; reading changelogs would never have told you this mattered. If your team pins agent versions for reproducibility, the gap between "we're on a stable version" and "we're on a safe version" is where Plugin4Shell lived for three months.

Gemini CLI: the disclosure says deprecated, the repository says otherwise

Air's timeline records that on 4 August 2026 Google confirmed no fix would ship because Gemini CLI is deprecated, and advised users to migrate to Antigravity. That claim is worth checking, so I checked it.

As of 18 September 2026, google-gemini/gemini-cli is not archived. It has 107,000 stars, 6,421 commits with the most recent landing hours before I looked, 628 published releases, and v0.60.0 tagged as the latest two days earlier. The README carries no deprecation notice of any kind; it still advertises the free tier, Gemini 3 models and MCP support in the present tense.

Both things can be true at once. Google may well have told Air it would not patch this specific flaw while the project continues shipping features, which is a different statement from "the tool is dead." Either way the outcome for a Gemini CLI user is the same: no patch is coming for the plugin checkout path, and installs from marketplaces on hosts that permit hash-shaped branch names stay exposed. Treat the plugin surface as unfixed regardless of what the repository's activity graph looks like.

Being stranded on an unfixed tool costs more than the exposure itself. Whatever you built up inside it, the skills and prompts and accumulated context about how your team works, is locked to that agent's local state. Memory that exports is memory you can take elsewhere when a vendor decides for you; Zentor keeps yours in a form you own rather than one you'd rebuild by hand.

What to check on your machine this week

Five things, and none of them take long.

Update the agent first, since it is the only complete fix where one exists. Claude Code at 2.1.179 or newer and Codex at 0.146.0 or newer are clear. On Copilot or Gemini CLI, no version helps.

Then inventory what you actually have installed. Most people turn on a plugin during one project and never revisit it, and this particular Claude Code plugin vulnerability only needs a plugin to be present, not to be used. Anything you cannot name a current reason for should come out.

Look at where each plugin's repository is hosted. GitHub rejects 40-hex branch names outright, blocking the main variant by accident. Bitbucket and self-hosted git allow them, and Anthropic's own marketplace documentation lists both as valid backends, so an entry pointing anywhere other than GitHub deserves a second look.

Turn off background plugin auto-update on any agent you cannot patch. It removes the zero-click property, which is the whole reason this became urgent rather than merely bad.

Finally, and this is the one people skip: check what the plugins can reach rather than what they do. Our walk through the official Claude Code plugin marketplace goes directory by directory through which entries carry an .mcp.json and therefore touch credentials, and that list is the real risk register.

Once you have that inventory, the question of where the audit trail lives gets sharper. A local agent's plugin state sits in a dotfile on one laptop, invisible to whoever reviews the work later. When the assistant puts the finished thing back into Notion or Airtable or the Slack thread the work already lives in, the record of what was produced sits where the reviewer is already looking, which is the part of Zentor's design that matters on a week like this one.

Pinning was the wrong thing to trust

Air's earlier work planted a malicious skill in a trusted marketplace and reached 26,000 agents, then hijacked 925 existing skills from their maintainers across 134,000 agents. Pinning was the industry's answer to that shape of attack, and Plugin4Shell is the story of the answer not working.

The honest read is that diligence was never going to scale here. Reading a plugin's source at install time, tracking the repo's ownership, re-reading it at every version bump: that is a job, and nobody does it on a Tuesday afternoon. What is left is reducing how many third-party repositories sit between you and the tool you actually wanted to reach. An assistant that works inside Notion, Canva, Slack and your inbox, and returns the finished artifact to those tools, needs fewer of them by construction. Zentor takes that route, which is a design decision rather than a promise about anyone's diligence.

The plugin ecosystem is still worth using. Update, inventory, be specific about what reaches your credentials. Our guide to agent security risks covers the wider category, and the fake tool output attack is a separate class worth reading alongside it.

Facts in this piece are as of 18 September 2026, from Air Security's disclosure and the vendors' own release pages.

FAQ

Am I affected by the Claude Code plugin vulnerability?

Only if you are running Claude Code older than 2.1.179 and have at least one marketplace plugin installed. The June release closed it. Since the current stream is at 2.1.275, most people updated past this months ago without knowing. Run claude --version to check.

Which version of each agent is safe?

Claude Code 2.1.179 and later, Codex 0.146.0 and later. GitHub Copilot has no fixed version as of 18 September 2026. Google has told Air it will not patch Gemini CLI.

Will I see an error if a plugin was swapped?

No, and that is the design of the attack. The checkout succeeds, the agent reports a successful install at the pinned commit, and the only trace at the git level is an ambiguous-refname warning. There is no user-visible error string to search for.

Does uninstalling plugins fix it?

It removes the delivery path: the attack needs a plugin already installed and an auto-update to fire, so an agent with no marketplace plugins has nothing to swap. On Copilot, trimming the installed set and disabling background updates are the two levers you have.

Is there a CVE for Plugin4Shell?

Air's write-up does not name one, and I could not find a CVE identifier assigned as of 18 September 2026. Track it by vendor version rather than by identifier.