Plugin Swap Flaw Exposed in Four AI Coding Agents

Security researchers have identified a vulnerability in four popular AI coding agents that allows attackers to replace legitimate plugins with malicious code. The flaw exploits a weakness in how these tools verify the source of their add-ons, potentially compromising the user's local environment without their knowledge.

The issue was disclosed by security firm Air Security, which noted that Anthropic and OpenAI have already released patches, while GitHub Copilot remains unfixed and Google has chosen not to address the flaw in its Gemini CLI. The risk is particularly acute for users who rely on automated updates, as the replacement can happen silently in the background.

Version locks fail on certain hosts

AI coding agents typically secure themselves by locking plugins to a specific version identified by a unique code string, or commit hash. However, Air Security found that these agents fetch the code but never verify that the downloaded content actually matches that hash. This creates a gap where the software believes it is installing a safe, reviewed version when it is actually receiving different code.

The trick relies on how some code hosting platforms handle branch names. If a repository owner creates a branch that looks like a valid commit hash, the agent may interpret the request for that hash as a request for that branch. Since the branch can point to any code the owner chooses, the agent installs the malicious payload while still reporting that it is on the locked, safe version.

GitHub restrictions limit the exploit

The attack does not work universally. GitHub, the most popular code hosting platform, prohibits branch names that resemble commit hashes. This restriction means that plugins installed from GitHub repositories are generally safe from this specific branch-naming trick. Most default plugin catalogs for Claude Code and Copilot are hosted on GitHub, which significantly reduces the risk for the average user.

However, the flaw persists on other platforms like Bitbucket or private enterprise servers that allow such naming conventions. The Hacker News verified that while the primary risk is limited to these alternative hosts, the Gemini CLI faces a different but related issue where a specific branch name can bypass GitHub's protections, leaving that tool vulnerable even on standard repositories.

Automatic updates increase exposure risk

The danger is amplified by the default setting for automatic updates in Claude Code and Codex. These agents can refresh their installed plugins in the background without asking the user. If a trusted plugin is swapped for malicious code during an update, the user may not realize their environment has been compromised until unauthorized actions occur.

Because the verification happens on the user's machine rather than the marketplace, the fix must come from the agent software itself. Users of affected versions should update their tools immediately, especially if they install plugins from non-GitHub sources or have enabled automatic updates for external repositories.