Air Security finds flaw in four AI coding agents lets plugin owners swap pinned code

September 18, 2026 at 04:01 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Security firm Air Security said on Thursday that a flaw in four widely used AI coding agents lets a plugin repository owner swap a pinned plugin for malicious code. Anthropic patched the flaw in Claude Code 2.1.179 and OpenAI in Codex 0.146.0, while GitHub Copilot has no fix and Google will not patch the retiring Gemini CLI.

Key Facts

Air Security reported the flaw on Thursday, affecting four AI coding agents: Claude Code, Codex, GitHub Copilot, and Gemini CLI.
Anthropic patched the flaw in Claude Code 2.1.179 and OpenAI in Codex 0.146.0.
GitHub Copilot has no fix, and Google will not patch the Gemini CLI, which is being retired.
The attack works by creating a branch named to look like a commit hash on hosts that allow such names, such as Bitbucket or a company's own git server.
Background auto-update, enabled by default in Claude Code and Codex, can replace a trusted plugin without user action.

Vulnerability Mechanism

The agents install plugins from online marketplaces, which lock each plugin to a specific reviewed version by its commit hash. Air Security found that the agents fetch the locked snapshot but never verify that the code they receive matches the commit hash. On code hosts that allow branch names resembling commit hashes, a repository owner can point that name to different code, causing the agent to install the different code while reporting it as the locked version. Because a plugin runs with the same access as the user, the swapped code can access files, saved credentials, and systems the user can log in to.

Affected Agents and Patches

Anthropic patched the flaw in Claude Code 2.1.179, and OpenAI patched it in Codex 0.146.0. GitHub Copilot has no fix, and Google will not patch the Gemini CLI, which it is retiring. The Gemini CLI can be attacked via a repository whose main branch is named FETCH_HEAD, which GitHub's rule against hash-shaped names does not clearly block.

Exposure and Mitigation

GitHub does not allow branch or tag names that look like commit hashes, so plugins installed from GitHub repositories are not exposed to the branch trick. The Hacker News checked the default marketplaces on September 18 and found that every plugin in Anthropic's community catalog and the default catalogs for Claude Code and Copilot points to a GitHub repository. Background auto-update runs by default in Claude Code and Codex, but only for the agents' built-in GitHub-hosted marketplaces, and is off or optional for outside ones. Users who install plugins only from the agents' default GitHub-based marketplaces are not exposed to the branch-name version of the attack, according to Air Security and GitHub documentation.