On June 17, three researchers at AIR — Or Nevo, Dor Granat, and Niv Hoffman — reported a vulnerability to Anthropic, OpenAI, Google, and Microsoft. They gave everyone 90 days to fix it before going public. September 17 was the deadline. The disclosure dropped on schedule.

What they found: four major AI coding agents — Claude Code, GitHub Copilot, OpenAI Codex, and Gemini CLI — all shared a variation of the same architectural mistake. Each one trusted plugin integrity verification in a way that a malicious plugin could bypass. The result in each case was the same: remote code execution with no interaction required from the developer using the tool. You install a plugin, the plugin is malicious, the agent runs code on your machine. Zero clicks.

The patch landscape is split. Claude Code and Codex shipped fixes during the embargo. Copilot is disputing the severity rating. Gemini CLI is deprecated and will not receive a fix. Here's what you need to know.

The shared mistake

A quick explanation of SHA-pinning and why bypassing it matters, because the mechanism is the whole story.

When a coding agent loads a plugin, it needs to verify that the plugin hasn't been tampered with. The standard way to do this is by checking a SHA-256 hash — a fixed fingerprint of the plugin's contents. If the fingerprint matches what's expected, the plugin is trusted. If it doesn't match, the agent refuses to run it.

The flaw AIR found is that each of these agents fetched the expected SHA from a location that the plugin itself had write access to — or could influence. In other words: the plugin could update the record of what its own fingerprint was supposed to be, then pass its own integrity check. This isn't a new class of vulnerability. It's a well-understood mistake in trust chain design. What's notable is that four independent tools made it independently.

Where each agent stands

Claude Code (Anthropic): Patched in v2.1.179. Check your version with claude --version. If you're below 2.1.179, update. npm update -g @anthropic-ai/claude-code or however you installed it. The fix was shipped under embargo, so it doesn't appear in the release notes under this vulnerability name — but the patch is real and the timeline is consistent.

Codex (OpenAI): Patched in v0.146.0. Same drill: check, update. npm update -g @openai/codex.

GitHub Copilot (Microsoft): This is the unresolved one. Microsoft's position, per the AIR disclosure, is that the scenario requires installing a malicious plugin in the first place, which they characterize as a separate threat model. The AIR team disagrees: their argument is that the plugin store's code review process is not a security boundary, and that once you grant the assumption that a plugin might be hostile, the SHA bypass is the mechanism that makes the RCE possible. This is a substantive technical disagreement, not a PR dodge. The risk to you depends on where you land on it. If you install Copilot plugins from sources you don't fully trust: be aware this dispute is active and the fix is not shipped.

Gemini CLI (Google): Deprecated. No patch coming. If you're still running it, you should be migrating anyway. This accelerates that timeline.

What no CVE means

AIR says no CVE has been assigned because the vulnerability doesn't fit cleanly into existing taxonomies — it sits between "insufficient verification" and "trust chain weakness" in a way that the current CVE classification system doesn't handle gracefully for agentic tools.

That's useful information in both directions. It means you won't find this in automated vulnerability scanners that key off CVEs. It also means the risk isn't inflated by whoever assigns severity scores — it's being assessed directly from the technical behavior. AIR rates it as high-severity for environments where developers have installed third-party plugins in affected agents.

Source spread

• AIR — Full disclosure — safety. Primary source: full technical write-up from the researchers who found it.
• AI Cybersecurity Monitor — Coverage — safety. Independent verification of the technical claims; covers the Copilot dispute in detail.
• Eastern Herald — News coverage — builder. Summarizes the per-agent patch status and embargo timeline.
• AI Daily Digest — Community tracking — builder/skeptic. Community-maintained tracking of patch status with links to changelog evidence.

What's actually serious and what isn't

Serious:

• The SHA bypass is architecturally real. Four independent implementations making the same mistake is notable. It suggests the pattern came from a shared assumption in how agentic tools think about plugin trust, not four separate oversights.
• Microsoft's non-patch is the live issue. Claude Code and Codex users on current versions have mitigations. Copilot users don't, and "the attacker would have to install a malicious plugin" is not a sufficient answer for teams where plugin installation policies are loose.
• The no-CVE status creates real detection gaps. If your security tooling depends on CVE feeds to flag vulnerable packages, this won't show up.

Less serious than it might seem:

• No exploitation in the wild has been reported. This is a pre-exploitation disclosure. The 90-day embargo gave vendors time to patch before attackers had the technical details.
• Claude Code and Codex are patched. If you update your tools (which you should be doing anyway), you're covered for the two patched implementations.
• The attack requires a malicious plugin. That's a meaningful precondition. It doesn't eliminate the risk — plugin stores have shipped malicious packages before — but it's not a "visiting a website is enough" scenario.

What builders need to do

Ordered by priority.

• Check your Claude Code version: claude --version. If it's below 2.1.179, update immediately: npm update -g @anthropic-ai/claude-code. This should take 30 seconds.
• Check your Codex version. Same check, different command: codex --version. Update if below 0.146.0: npm update -g @openai/codex.
• If your team uses GitHub Copilot with third-party plugins: audit which plugins are installed and from which publishers. Microsoft's dispute means no patch is coming; the risk mitigation is reducing your plugin attack surface. Remove plugins you don't actively use.
• Migrate off Gemini CLI. This vulnerability is a reason to accelerate, not the only reason. Google has stopped updating it.
• If you run automated agents in CI: review whether they have plugin loading enabled and whether that's strictly necessary. Plugins in CI pipelines are a wider attack surface than plugins on developer machines.
• Don't wait on CVE feeds to catch this. No CVE means no automated scanner alert. Manual checks are the only coverage you have here.

Further reading

• AIR — Plugin4Shell full technical disclosure — the primary source
• Claude Code release notes — v2.1.179 — Anthropic's patch
• OpenAI Codex release notes — v0.146.0 — OpenAI's patch
• GitHub Copilot security advisories — Microsoft's current position
• AIR — coordinated disclosure methodology — how they handle disclosure timelines