Plugin4Shell Lets Repository Owners Swap Pinned Plugin Code Across Four AI Coding Agents
Flaw in AI coding agents allows repo owners to swap pinned plugin code for malicious versions.
A vulnerability dubbed Plugin4Shell affects four major AI coding agents, allowing repository owners to substitute malicious code for legitimate, pinned plugins. This occurs even when the agent has locked the plugin to a specific reviewed version. While Anthropic and OpenAI have released patches, GitHub Copilot remains unfixed, and Google will not patch the retiring Gemini CLI. The attack exploits how some Git hosts permit branch names that mimic commit hashes, enabling the agent to install different code while reporting the pinned version.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Anthropic?
Get an email when a new story names Anthropic, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonPlugin4Shell exposes a fundamental trust assumption flaw in AI coding agents: pinning a plugin to a specific commit hash does not guarantee integrity when Git hosting platforms allow branch names that visually mimic commit hashes. Attackers with repository owner privileges can silently substitute malicious code while the agent reports installing the expected, reviewed version — a classic software supply chain substitution attack. This matters because developers rely on version pinning as a security control, and its silent bypass can introduce backdoors or malicious payloads into codebases with no visible warning. The fact that GitHub Copilot remains unpatched and Google has declined to fix Gemini CLI leaves millions of developers exposed with no automatic remediation path.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- AI application security
Prompt injection, data leaks through AI tools and unapproved AI use get caught.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.