THE VERDICT
● Anthropic: patched. Claude Code 2.1.179.
● OpenAI: patched. Codex 0.146.0.
● Microsoft: no fix released for GitHub Copilot.
● Google: deprecated Gemini CLI rather than patching it.
Why this is a fair comparison
Vendor response is usually impossible to compare, because every incident is different. Not this one. AIR disclosed the same flaw to all four vendors in the same window, and it worked the same way in each product. Same problem, same clock, four answers.
| Vendor | Product | Response | User action |
|---|
| Anthropic | Claude Code | Patched | Update to 2.1.179 |
| OpenAI | Codex | Patched | Update to 0.146.0 |
| Microsoft | GitHub Copilot | No fix released | Audit your plugins |
| Google | Gemini CLI | Deprecated the product | Uninstall it |
Deprecation is a legitimate answer, and an incomplete one
Retiring a product rather than patching it is a real decision with real logic. If nobody is meant to be using Gemini CLI any more, spending engineering time on it is hard to justify.
BUT A DEPRECATED TOOL DOES NOT UNINSTALL ITSELF
It keeps running on every machine where it is installed, keeps pulling plugins, and keeps holding whatever credentials it was given.
Deprecating transfers the remediation work to users without necessarily telling them there is work to do. For a vulnerability this class, the end-of-life notice and the security advisory need to be the same message.
What to read into it, and what not to
- Do not read it as a ranking of engineering quality. All four shipped the same bug. That is the more interesting fact.
- Do read it as a signal about maintenance posture. Two vendors treat their agent as a supported product with a security process. One has not responded yet. One has moved on.
- Weigh it if you are choosing a tool to depend on. You are not just picking today's capability, you are picking who fixes it in eighteen months.
- Microsoft may still ship a fix. This is a snapshot, not a verdict, and we will update it if that changes.
The question this should make you ask
Before you give any agent credentials, find out whether the vendor publishes security advisories for it, whether it has a version you can pin, and whether anyone has ever shipped a security patch for it. A coding agent runs with your repository access and your shell. That is a supported-software decision, not a productivity-tool decision.
The full technical explanation of the flaw →
FAQ
Which coding agents are patched against Plugin4Shell?
Claude Code from version 2.1.179 and Codex from 0.146.0. GitHub Copilot has no fix at the time of writing, and Google deprecated Gemini CLI rather than patching it.
Is Gemini CLI safe to keep using?
No. It was deprecated rather than fixed, so the flaw remains. Remove it.
Does this mean Claude Code and Codex are more secure?
It means they were maintained faster on this issue. All four shipped the same underlying flaw, which is the more useful thing to know.
Should vendor response change which agent I pick?
It should be one input. Capability matters, but so does who ships a patch when a researcher finds something in a tool holding your credentials.