Plugin4Shell Vulnerability Exposes AI Coding Agents to Supply-Chain Attacks

A security flaw identified by Air Security allows repository owners to swap pinned plugin code across four widely used AI coding agents, bypassing version pinning mechanisms that are intended to ensure agents install only reviewed, specific versions of plugins. The vulnerability, tracked as Plugin4Shell, affects the supply chain of AI-assisted development tools, potentially enabling arbitrary code execution within developer environments.

According to reporting by The Hacker News, the flaw affects Anthropic's Claude Code, OpenAI's Codex, and GitHub Copilot. Air Security reported that Anthropic has released a patch in Claude Code version 2.1.179 and that OpenAI has patched the issue in Codex version 0.146.0. As of the report's publication, GitHub Copilot has no available patch.

The technical mechanism involves an attacker who controls a plugin's code repository replacing the legitimate plugin code with malicious content. Even when an AI coding agent is configured to install a specific pinned version of a plugin, the agent may still download and execute the updated, malicious version from the repository. This compromises the integrity of the development environment and could lead to data theft, arbitrary code execution, or further compromise of the host system.

The fourth affected AI coding agent was not explicitly named in the initial report, and detailed technical analysis beyond the high-level description has not been publicly disclosed. No CVE identifier has been assigned to this vulnerability at the time of reporting.