Plugin4Shell flaw lets plugin owners swap code in AI coding agents

Security firm Air Security disclosed a vulnerability it calls Plugin4Shell on Thursday 18 September 2026, saying a flaw in four widely used AI coding agents lets someone who controls a plugin's code repository swap the plugin an agent installs for a malicious one. According to the firm, this works even when the agent has locked the plugin to a specific, reviewed version.

The agents named in the disclosure include Anthropic's Claude Code, OpenAI's Codex and GitHub Copilot. Air Security said Anthropic has patched the flaw in Claude Code 2.1.179 and OpenAI has patched it in Codex 0.146.0. GitHub Copilot has no fix, according to the firm. A fourth affected agent is referenced in the disclosure but is not named in the available reporting.

The issue is a supply chain problem rather than a bug in the models themselves. AI coding agents can be extended with plugins, which are packages of code and instructions that add capabilities such as new tools or workflows. Teams that want to control what runs on their machines often pin a plugin to a particular version, so that the agent installs the exact code that was reviewed rather than whatever the latest release happens to be. Air Security's finding is that this control did not hold: the party that controls the plugin's repository could still change what the agent actually fetched and ran.

That matters because coding agents typically run with broad access. They read and write source code, execute commands and, in many setups, hold credentials for repositories and build systems. A plugin that silently changes content after review is therefore a route to running attacker-chosen code inside a developer's environment, without the developer approving a new version.

The practical response for teams using these tools is to upgrade. Users of Claude Code should move to 2.1.179 or later, and users of Codex to 0.146.0 or later, based on the versions Air Security cited as fixed. Organisations relying on GitHub Copilot plugins do not have a patched version to move to, according to the firm's disclosure.

The disclosure does not describe any confirmed exploitation in the wild, and the available reporting does not detail the technical mechanism behind the flaw or say how long the affected versions were vulnerable. It also does not say when the vendors were notified or when the fixed releases shipped. The Agentic Times has not independently verified the findings.

Plugin4Shell adds to a pattern of security problems that sit in the plumbing around agents rather than in the agents' reasoning. Version pinning is one of the few controls a team can apply to third-party agent extensions without reading every update by hand. A flaw that makes pinning unreliable weakens the assumption that a reviewed plugin stays reviewed, and it puts the burden back on whoever owns the upstream repository. For now, the only remedy Air Security points to is the patched releases from Anthropic and OpenAI.