Plugin4Shell Lets Repository Owners Swap Pinned Plugin Code Across Four AI Coding Agents

A security flaw in four AI coding agents (Claude Code, Codex, GitHub Copilot, and Gemini CLI) allows someone controlling a plugin's code repository to swap in malicious code even when the agent is locked to a specific reviewed version. The vulnerability works by creating a branch with a name that looks like a commit hash (a long string identifying exact code), tricking the agent into installing different code while reporting it installed the locked version, giving the malicious code access to the user's files and credentials.