Version-Locked AI Coding Plugins Can Be Swapped for Malicious Code, Researchers Find

A flaw dubbed Plugin4Shell lets whoever controls a plugin's code repository replace the plugin an AI coding agent installs with a malicious one - even when the agent has locked that plugin to a specific reviewed version, security firm Air Security said Thursday.

The four affected agents pull plugins from online marketplaces, which pin each plugin to a reviewed version by its commit hash, a string identifying an exact code snapshot. Air found the agents fetch that snapshot but never verify the code they receive matches it. On code hosts that allow a branch named to resemble the commit hash, a repository owner can point that name at different code, and the agent installs it while still reporting the locked version.

Because plugins run with the user's own access, swapped code can reach that person's files, saved credentials and the systems they can log into, Air said.

Anthropic has patched the flaw in Claude Code 2.1.179 and OpenAI in Codex 0.146.0, Air said. GitHub Copilot has no fix, and Google will not patch the Gemini CLI, which it is retiring. Each agent checks the lock on the user's machine rather than at the marketplace, so only the agent itself can fix the issue.

The trick does not work everywhere. GitHub blocks branch and tag names that look like commit hashes, so plugins installed from GitHub repositories are not exposed to the branch trick, though Air says it works on hosts permitting such names, such as Bitbucket or a company's own git server. The Gemini CLI is attacked differently: its installer can be fooled by a repository whose main branch is named FETCH_HEAD.

Background auto-update, on by default in Claude Code and Codex, could let a trusted plugin be replaced without any user action. Air says it built a working test attack against all four agents in May and notified vendors in June. As of September 18, no CVE identifier had been assigned and no vendor had published a security advisory, and there is no sign of real-world use. The sources do not say whether updating removes a plugin already swapped.

Source: The Hackers News