Two of the Four Vendors Told About Plugin4Shell Are Not Shipping a Fix. One Says the Product Is Deprecated.

The Israeli security firm AIR disclosed a vulnerability it calls Plugin4Shell on 17 September 2026, with coverage following from Help Net Security and others on the 18th. It is a zero-click remote code execution flaw affecting all four of the major AI coding agents — Anthropic’s Claude Code, OpenAI’s Codex, GitHub Copilot and Google’s Gemini CLI — and it works by defeating SHA pinning, the mechanism developers rely on to lock a plugin to a specific reviewed commit.

The disclosure worked. The remediation did not, and that is the part worth your attention. Anthropic shipped a patch in Claude Code 2.1.179. OpenAI shipped one in Codex 0.146.0. Microsoft, told about the same flaw in Copilot, has not shipped a fix. Google deprecated Gemini CLI and told the researchers it will not ship a patch at all.

Coordinated disclosure rests on an assumption that nobody writes down: that a vendor’s answer to a valid report is when, not whether. For two of four agents here, the answer is whether — and the published advisory is now a working description of an exploit against an unpatched, still-running install base. That is the precise outcome an embargo period exists to prevent.

What broke

SHA pinning is a simple and normally sound idea. A plugin is reviewed at a particular commit. The agent records that commit’s hash. On every subsequent install or update, the agent checks out that exact hash, so what runs is byte-for-byte what a human reviewed. Pinning to a hash rather than a branch or a tag is the standard defence against a maintainer — or someone who has taken over a maintainer’s account — quietly moving the reference to new code.

The failure is narrower and more embarrassing than a flaw in that reasoning. According to the research, the agent pins the plugin to a commit hash and issues the checkout for that hash, but once the checkout finishes it never confirms that it actually arrived there. The hash is used as an instruction and never as a verification. Everything downstream inherits the assumption that the instruction was obeyed.

The consequence is that a malicious plugin update can execute attacker-controlled code without the user clicking, approving, or reinstalling anything. Zero clicks is not marketing here; it follows directly from the fact that plugin updates are a background operation the user is not asked about, because pinning was supposed to make them safe.

What the executing code can reach is whatever the developer can reach. AIR’s characterisation is that plugins inherit the permissions of the developer running the agent: local source, cloud credentials, SSH keys, internal repositories, production systems and secrets. That is the researchers’ framing rather than an audited inventory, but it is not an exotic claim — a coding agent with a working development environment holds most of those by design.

One thing to be clear about: no exploitation in the wild has been claimed, and no incident, breach or data loss has been reported. And no CVE identifier for Plugin4Shell has been confirmed. If you see one quoted, check it.

The four-way split

This is the table that matters, and the one that will go stale first — vendor status can move, and it is worth rechecking before you act on it.

• Anthropic, Claude Code — patched after disclosure, in version 2.1.179.
• OpenAI, Codex — patched after disclosure, in version 0.146.0.
• Microsoft, GitHub Copilot — no fix shipped. Users have no patched version to move to.
• Google, Gemini CLI — deprecated, and Google told AIR it will not patch. The stated migration path is Antigravity, which the researchers say this attack does not reach, because it has no marketplace plugin SHA pinning to bypass.

Two patched, one silent, one declining. The interesting case is the declining one, because it is the one with a reasoned position behind it.

“Deprecated” is not “uninstalled”

Google’s position deserves to be stated at full strength before it is argued with, because it is defensible. A deprecated product has no supported version to patch into. Shipping a security fix implies an ongoing support relationship the vendor has formally withdrawn, and doing it once creates an expectation it will happen again. Deprecation is announced precisely so that users migrate, and the coherent remediation for a vulnerability in an end-of-life product is migration, not a patch. Google has also named a specific destination — Antigravity — that the researchers agree is not reachable by this attack. That is more than most end-of-life notices offer.

Now the question it leaves. Deprecation is a statement about a vendor’s roadmap. It is not a statement about what is installed on developer machines. Nothing about deprecating a CLI uninstalls it, expires it, or revokes the credentials a plugin running inside it inherits. A developer who installed Gemini CLI eighteen months ago, wired it into a repository and moved on has no mechanism that tells them any of this happened. They did not read the deprecation notice. They will not read the advisory.

So the practical question is who is responsible for reaching that person, and coordinated disclosure has no answer. The model routes notification through the vendor, on the premise that the vendor will attach a patch to it. Remove the patch and the notification channel does not automatically survive; a vendor that has decided not to fix a product has limited incentive to broadcast that it is vulnerable. Meanwhile the advisory is public, because publishing it after the embargo is the other half of the bargain.

For Copilot the situation is different in kind, not degree. Microsoft has not declined — it has simply not shipped. That could mean a fix is in progress, or it could mean the report is queued behind other work. The practical position for a user is the same either way: no patched version exists today, and the flaw is publicly described.

If you are running either of the unpatched agents, the mitigations available to you are all blunt: remove the agent, remove its plugins, or narrow what it can reach — scoped credentials rather than long-lived ones, no SSH agent forwarding into the agent’s environment, and no access to production secrets from a development machine running it. None of those fix the flaw. They reduce what inheriting the developer’s permissions is worth.

The other half: 155 expired domains

AIR published a second, separate piece of research — it calls this one MCPJacking, and it is not part of Plugin4Shell, though several write-ups have merged them. Researchers Nadav Dadush, Eliad Mualem and Roi Snir identified 155 entries in the official MCP Registry whose underlying services were offline and whose associated domains had expired. They registered those domains, stood up their own MCP servers at the trusted registry addresses, and gained remote prompt execution on every agent that still trusted the stale entry. A hijacked server of that kind can alter tool definitions, inject prompts, redirect agent actions and exfiltrate whatever the agent can see.

The count and the scope figures are AIR’s own, published by the firm that discovered and named the issue, and have not been independently audited. The same applies to the description of Plugin4Shell as “the first supply chain vulnerability of the AI agent ecosystem” — that is a marketing line, and prior incidents complicate it. Branded vulnerabilities with logos and names are a distribution strategy as much as a disclosure format. None of that makes the findings wrong; it means the numbers carry a vendor’s name and should be reported with it attached.

The mechanism, though, is the same one as Plugin4Shell viewed from a different angle. In both cases a trust anchor is pointing at something that can change underneath it — a commit that was never verified after checkout, a domain that was never re-checked after registration. A hash and a domain name are both identifiers that look permanent and are not. Pinning to something is only as strong as the step where you confirm that the thing you pinned to is still what you got.

Registry hygiene is the unglamorous fix for the second one, and it is nobody’s job right now. Domain expiry is not a security event that anybody monitors on behalf of a registry, which is exactly why 155 of them were sitting there to be found.