Affected Systems
Four AI coding agents: Anthropic Claude Code (fixed in 2.1.179), OpenAI Codex (fixed in 0.146.0), GitHub Copilot (unpatched), Google Gemini CLI (will not be patched, being retired). Vulnerability affects plugins installed from non-GitHub repositories (Bitbucket, self-hosted Git servers) that allow branch names resembling commit hashes. GitHub-hosted plugins are not vulnerable to the branch-name attack vector.
Exploitation Status
Proof-of-concept developed by Air Security in May 2026. No evidence of active exploitation in the wild. No CVE assigned as of September 18, 2026. Vendors notified in June 2026.
Business Impact
Attackers who control a plugin repository can substitute malicious code despite version pinning, gaining access to developer credentials, files, and connected systems with the same privileges as the user. Risk is highest for organizations using AI coding agents with plugins from non-GitHub sources (Bitbucket, self-hosted Git). Auto-update feature in Claude Code and Codex increases risk but only applies to GitHub-hosted default marketplaces, which are not vulnerable to the primary attack vector. GitHub Copilot remains unpatched with no timeline provided.
Urgency
🟠Within 24 hours
Recommended Actions
- Update Anthropic Claude Code to version 2.1.179 or later immediately
- Update OpenAI Codex to version 0.146.0 or later immediately
- For GitHub Copilot users: restrict plugin installations to GitHub-hosted repositories only until a patch is released
- Migrate from Google Gemini CLI to Antigravity as recommended by Google
- Audit installed plugins across all AI coding agents and remove any sourced from Bitbucket or self-hosted Git servers
- Disable auto-update for plugins from non-default marketplaces in Claude Code and Codex
- Monitor for unexpected plugin behavior or unauthorized access attempts from developer workstations using AI coding agents