Security firm Air Security disclosed a flaw that lets whoever controls an AI coding agent's plugin repository replace the plugin an agent installs even when the marketplace has pinned it to one reviewed version. The agents fetch the reviewed snapshot but never verify that the code they end up with matches it; on a code host that permits a branch or tag named to look like a commit hash, the repository owner can point that name at different code, and the agent installs it while reporting it is on the pinned version. Because plugins run with the user's own access, swapped code reaches their files, saved credentials and reachable systems. Anthropic patched Claude Code 2.1.179 and OpenAI patched Codex 0.146.0; GitHub Copilot has no fix, and Google will not patch the retiring Gemini CLI, whose installer can instead be tricked by a repository whose main branch is named FETCH_HEAD. GitHub blocks hash-shaped branch and tag names, so GitHub-hosted plugins are not exposed; Bitbucket and self-hosted git servers are.

• Source article