A security vulnerability in four widely used AI coding agents allows attackers to replace trusted plugins with malicious versions, even when those plugins are locked to specific reviewed code snapshots. Security firm Air Security discovered the flaw, which affects Anthropic's Claude Code, OpenAI's Codex, GitHub Copilot, and Google's Gemini CLI. The researchers built a working test attack in May and disclosed it to vendors in June.

How Does This Plugin Swap Attack Actually Work?

AI coding agents install add-ons called plugins from online marketplaces. To prevent tampering, marketplaces lock each plugin to a single reviewed version using a commit hash, a long string that uniquely identifies an exact snapshot of code. The problem: the agents fetch that snapshot but never verify that the code they actually receive matches the locked version.

Attackers exploit this gap using a clever Git trick. On code hosting platforms that allow branch or tag names to look like commit hashes, a plugin repository owner can create a branch with a name that mimics the commit hash. The agent then installs different code from that branch while still reporting it is on the locked version. Because plugins run with the same access as the person using the agent, the swapped code can access their files, saved credentials, and systems they can log in to.

The attack's reach varies by platform. GitHub does not allow branch or tag names that look like commit hashes, so plugins installed from GitHub repositories are protected. However, the vulnerability works on platforms that permit such names, including Bitbucket and company-owned Git servers, which these agents also support.

Which AI Coding Agents Are Affected and What's the Current Status?

The vulnerability impacts all four major agents, but their patch status differs significantly:

• Claude Code: Anthropic patched the flaw in version 2.1.179. Users should update to this version or later to close the vulnerability.
• Codex: OpenAI released a fix in version 0.146.0. The company's own public fix describes the bug as Git being able to "interpret a requested commit SHA as a branch name," which can make a plugin source "materialize a different commit than the one it pinned."
• GitHub Copilot: No fix has shipped. Air Security says it informed Microsoft in June, but no patch is available. Copilot can install plugins from hosts other than GitHub, which is where the risk sits.
• Google Gemini CLI: Google will not patch the consumer version. The company stopped serving the Gemini CLI in June and has been directing users to Antigravity, its newer agent, which Air Security says this attack cannot reach.

As of September 18, no CVE identifier had been assigned, and none of the four vendors had published a security advisory for the flaw. There is no sign it has been used in a real attack.

How to Protect Yourself From This Plugin Vulnerability

The risk level depends on where you install plugins and which agent you use. Here are practical steps to reduce exposure:

• Update Your Agent Software: If you use Claude Code or Codex, update immediately to version 2.1.179 and 0.146.0 respectively. Outdated versions remain vulnerable to the branch-name attack.
• Install Plugins Only From Default Marketplaces: Both Anthropic and GitHub host their default plugin marketplaces on GitHub, which blocks hash-shaped branch names. Installing plugins exclusively from these official, GitHub-hosted catalogs protects you from the branch-name version of the attack.
• Disable Auto-Update for Third-Party Plugins: Background auto-update is on by default for the agents' built-in marketplaces but off or optional for outside ones. If you use third-party plugin sources, ensure auto-update is disabled so plugins cannot be silently replaced without your knowledge.
• Switch From Gemini CLI: If you use Google's Gemini CLI, migrate to Antigravity, Google's newer agent, which Air Security says is not vulnerable to this attack.

Why This Matters Beyond the Technical Details

This vulnerability reveals a fundamental trust gap in how AI coding agents handle plugins. Each agent checks the version lock on the user's own machine, not at the marketplace level, so no marketplace can fix this for users. The fix must ship in the agent itself.

The attack is particularly dangerous because it can work silently. Auto-update runs by default in Claude Code and Codex, meaning a plugin someone already trusts could be replaced without any prompt or notification. However, this silent replacement only occurs for plugins from the agents' own built-in marketplaces, which are hosted on GitHub and therefore protected by GitHub's naming rules.

This is not the first time Air Security has found plugin vulnerabilities in these agents. In June, the firm tested a fake skill that passed security scanners and reached approximately 26,000 agents by changing an external link after the review had cleared it. Plugin4Shell moves that attack vector from a swapped link to a swapped plugin sitting behind a version lock, demonstrating how attackers continue to find new angles to compromise AI agent ecosystems.

The broader lesson is that as AI coding agents become more integrated into developer workflows, the security of their plugin ecosystems becomes critical. Developers should stay informed about patches, understand where their plugins come from, and regularly audit which add-ons they have installed and what permissions they hold.