Plugin4Shell Lets Repository Owners Swap Pinned Plugin Code Across Four AI Coding Agents

Summary

Air Security reports a flaw in four AI coding agents that lets the owner of a plugin's repository swap in different code while the agent reports the locked, reviewed version. The trick exploits Git treating a commit hash as a branch name on hosts that allow such names, such as Bitbucket or self-hosted git servers, and the swapped plugin runs with the user's own access. Anthropic fixed it in Claude Code 2.1.179 and OpenAI in Codex 0.146.0, GitHub Copilot has no fix, and Google will not patch the Gemini CLI.

Mitigation

Fixed in Claude Code 2.1.179 and Codex 0.146.0; update to these or later versions. No fix for GitHub Copilot or the Gemini CLI is stated in the source.

Topics

• AI agents

Related items

• InfoJim Cramer has three lingering questions about Anthropic ahead of its historic IPOSame vendor · CNBC Technology
• Infollm-gemini 0.37Same vendor · Simon Willison's Weblog
• InfoGoogle’s new Gemini model is better at understanding complicated questionsSame vendor · The Verge (AI)
• MediumGHSA-68g8-gh8f-7rhg: pgEdge RAG Server discloses part of the configured provider credential through API error messagesSame vendor · GitHub Advisory Database
• InfoHow Amplitude ships product improvements in 1–2 days with OpenAISame vendor · OpenAI Blog