Four Things to Do First
The action items matter more than the analysis here, so they go at the top. Update Claude Code to **2.1.179 or later** and Codex to **0.146.0 or later**. Gemini CLI will not get a patch — it is deprecated, and Google's path is migrating to Antigravity. GitHub Copilot had no client fix at public disclosure, so teams installing plugins through it can currently only reduce exposure by reducing plugin surface. The fourth item is the one almost nobody does, and possibly the most important: **look at where the plugins you have installed are actually hosted.** The reason is in the next section.
The Real Line of Defense Turns Out to Be a Git Host's Naming Rule
The core move in this attack is creating a branch whose name looks like a commit hash. Whether that is possible depends on whose server the repository lives on. GitHub says it does not allow users to create branch or tag names resembling commit SHAs, and GitLab enforces the same restriction. Bitbucket and self-hosted git servers do not. Which means that, aside from the agent-side patches, **what currently blocks this attack is a naming rule at the hosting provider** — and whether that rule exists depends on where a plugin marketplace put its repositories, not on which agent you use. That is why GitHub's position on not being affected needs reading on its own terms: the claim holds within what GitHub itself hosts, and does not extend to marketplaces hosted elsewhere. For a user, the conclusion is that this exposure cannot be judged by "which agent am I on" alone. It also has to be judged by which git host the plugins are pulled from — a dimension most people have never audited.
You Get Hit Just by Having It Installed, and the Qualifying Condition Is Doing Things Right
The property worth remembering is that this is zero-click. Claude Code and Codex update plugins automatically from their built-in marketplaces by default, so an attacker does not need to convince anyone to install anything new — the plugin you installed long ago pulls the rewritten upstream content down on its own. The victim profile deserves a pause. **The "mistake" required of you is installing a reviewed plugin from a trusted marketplace that was pinned exactly as the security model prescribes.** People following best practice are precisely the ones in range. And because plugins inherit the developer's permissions, the consequences are concrete: local source, cloud credentials, SSH keys, internal repositories and production systems all sit in the same bag of privileges. A separate figure from AIR gives a sense of scale: 925 compromised skills reaching roughly 134,000 agents. That number describes plugin takeovers as a standing problem rather than Plugin4Shell itself, but putting the two together is what shows how much surface the distribution layer now has.
Four Independent Implementations, All Missing the Same Step
This is not one company's oversight. Four independent teams wrote the same error, which means what was missing was not care but a step in the pattern itself. The fix is straightforward: after checkout, resolve the actual commit and compare it to the pin. The difficulty is that this step can only happen inside the agent — no marketplace can guarantee it for you, because the thing being bypassed is precisely whether the marketplace's pin was ever enforced. So for as long as an agent goes unfixed, its users have no complete mitigation. Place this in the thread this site has been following through the year and the escalation is clear: we have covered poisoned packages on RubyGems aimed at agents, and a LiteLLM MCP auth bypass entering KEV. The attack point moved from the model, to the agent itself, and Plugin4Shell strikes the **distribution layer** — the pipe through which marketplaces push add-on capability onto millions of machines. AIR's framing of it as the first supply chain vulnerability of the AI agent ecosystem holds up. One judgment to take away: once your agent supports auto-updating third-party extensions, your trust boundary stops being "what did I install" and becomes "along the chain behind what I installed, who did each link decide to trust."
via: AIR's research, Help Net Security, The Register, InfoWorld