A critical vulnerability has been identified in four prominent AI coding agents, allowing repository owners to swap pinned plugins with potentially harmful alternatives. This flaw, discovered by Air Security, affects agents like Claude Code and Codex, where the code installation process does not verify if the fetched code aligns with the locked version by its commit hash. Although Anthropic and OpenAI have patched this issue in Claude Code 2.1.179 and Codex 0.146.0, respectively, GitHub Copilot remains unpatched, and Google will not update the retiring Gemini CLI.

This vulnerability is particularly concerning as plugins operate with the same permissions as users, potentially granting malicious code access to sensitive files and credentials. However, plugins sourced from GitHub are not susceptible to this branch naming trick, as GitHub prohibits branch names that mimic commit hashes. The attack is more effective on platforms like Bitbucket or private git servers that allow such naming conventions.

The Gemini CLI is vulnerable in a different manner. Its installer can be deceived by a repository with a main branch named FETCH_HEAD, bypassing GitHub's restrictions against hash-shaped names. Auto-update features in Claude Code and Codex exacerbate the risk, as they can replace trusted plugins automatically without user intervention. Despite the potential for widespread impact, no real-world exploitation has been reported, and no CVE identifier has been assigned as of September 18. Security advisories from vendors are also absent, highlighting a significant gap in communication and response.

While individual marketplaces cannot address this flaw due to its nature, the solution must come from within the agents themselves. As vendors continue to address the issue, it remains crucial for users to stay informed and cautious about the plugins they use.