DO THIS FIRST
● Claude Code: update to 2.1.179 or later. Patched by Anthropic.
● Codex: update to 0.146.0 or later. Patched by OpenAI.
● GitHub Copilot: no fix released at the time of writing.
● Gemini CLI: Google deprecated the tool rather than patching it. Users remain exposed.
What the flaw actually is
Every one of these agents supports plugins, and every one of them tries to be careful about it. The plugin is pinned to a specific commit hash that somebody reviewed. That is the right idea.
The problem is what happens next. All four agents check out the pinned commit without verifying that the checkout actually landed on it.
On some git platforms — Bitbucket and self-hosted servers among them — a branch is allowed to have a name identical to a commit hash. Ask for that hash and you may get the branch instead. The pin still looks correct. The code is somebody else's.
ZERO-CLICK MEANS ZERO CLICKS
The user does not approve anything. They do not install anything new. The agent fetches a plugin it already trusts, on a schedule, and runs whatever came back.
A coding agent runs with your credentials, your repository access and your shell. Remote code execution in that context is not a sandbox escape. It is already inside.
Patch status
| Agent |
Vendor |
Status |
| Claude Code | Anthropic | Patched in 2.1.179 |
| Codex | OpenAI | Patched in 0.146.0 |
| GitHub Copilot | Microsoft | No fix released |
| Gemini CLI | Google | Deprecated instead of patched |
The part worth sitting with
Four independent teams, at four companies that compete with each other, built the same plugin-pinning mechanism and made the same mistake in it.
That is not four bugs. It is one assumption that everybody inherited — that asking git for a commit hash gets you that commit — and nobody checked because it is true almost everywhere.
The researchers at AIR found it in May and disclosed to vendors the following month. It became public this week. The gap between those dates is its own story, and a familiar one after Google took seven weeks on the Gemini evaluation finding.
Deprecating is not patching
Google's response to Gemini CLI was to retire it. For a tool nobody is using any more that is a reasonable end of life. For a tool still installed on developer machines it moves the work to the user without telling them there is work to do, and a deprecated tool does not stop running on the day it is deprecated.
If Gemini CLI is on your machine, remove it rather than waiting for a fix that is not coming.
What to do beyond updating
- Check your agent version today. Two commands, and two of the four have a number to hit.
- Audit which plugins your agent actually loads. Most people do not know. The list is usually shorter than expected and occasionally contains something nobody remembers adding.
- Look at where those plugins are hosted. The attack needs a platform that permits a branch named after a commit hash. Self-hosted git and Bitbucket qualify.
- Treat agent credentials as production credentials. If your coding agent can push, deploy or read secrets, then a plugin supply-chain flaw is a production incident, not a developer-tools one.
Sources
FAQ
What is Plugin4Shell?
A zero-click remote code execution flaw in the plugin systems of Claude Code, Codex, GitHub Copilot and Gemini CLI. All four pin plugins to a reviewed commit hash but do not verify that the checkout landed on that commit, so an attacker can substitute code while the pin still appears valid.
Which versions are safe?
Claude Code 2.1.179 or later, and Codex 0.146.0 or later. GitHub Copilot has no fix at the time of writing, and Google deprecated Gemini CLI rather than patching it.
Do I have to click anything to be affected?
No. That is what zero-click means here. The agent fetches a plugin it already trusts and executes what it receives.
How does the attack work?
Some git platforms allow a branch name identical to a commit hash. When the agent asks for the pinned hash it can receive the branch instead, and it never checks which one it got.
Am I at risk if my plugins are on GitHub?
The technique relies on a platform permitting a branch named after a commit hash, which is reported on Bitbucket and self-hosted servers. Update regardless — the fix costs you nothing and the audit is worth doing.
Should I stop using coding agents?
No. Two of the four shipped fixes quickly. Update them, remove the deprecated one, and check what your agent is allowed to reach.