Full Report
A flaw in four widely used AI coding agents lets someone who controls a plugin's code repository swap the plugin an agent installs for a malicious one, even when the agent locked that plugin to a specific reviewed version, security firm Air Security said on Thursday. The firm said Anthropic has patched the flaw in Claude Code 2.1.179 and OpenAI in Codex 0.146.0, that GitHub Copilot has no
Analysis Summary
# Vulnerability: AI Coding Agent Plugin Hijacking (Supply Chain Attack)
## CVE Details
- **CVE ID**: Not explicitly provided in the text (often assigned as vendor-specific internal IDs for SaaS tools).
- **CVSS Score**: Not provided (Estimated High/Critical based on Remote Code Execution potential).
- **CWE**: CWE-494: Download of Code Without Integrity Check / CWE-353: Missing Support for Integrity Check.
## Affected Systems
- **Products**:
- Anthropic Claude Code
- OpenAI Codex
- GitHub Copilot (Status cited as "no [patch]" or "no [vulnerability]"—text cut off)
- One additional unnamed AI coding agent (referenced as "four widely used agents").
- **Versions**:
- Claude Code versions prior to **2.1.179**.
- OpenAI Codex versions prior to **0.146.0**.
- **Configurations**: Systems utilizing external plugins or extensions where version locking/pinning is enabled.
## Vulnerability Description
The flaw resides in the mechanism AI coding agents use to fetch and verify plugins from code repositories. Even when an agent is configured to "lock" or "pin" a plugin to a specific reviewed version (commit hash or version tag), a flaw allows a malicious repository maintainer to bypass this restriction. The agent fails to properly validate the integrity of the downloaded package, allowing the server-side repository to serve malicious code in place of the expected, reviewed version.
## Exploitation
- **Status**: Discovered by security firm Air Security; no report of exploitation in the wild.
- **Complexity**: Medium (Requires control over a plugin's code repository or a man-in-the-middle position on the repository host).
- **Attack Vector**: Network (Supply Chain).
## Impact
- **Confidentiality**: High (Malicious plugins can exfiltrate source code, environment variables, and credentials).
- **Integrity**: High (Arbitrary code execution within the developer's environment).
- **Availability**: Medium (Potential for destructive actions on the local workspace).
## Remediation
### Patches
- **Anthropic Claude Code**: Update to version **2.1.179** or later.
- **OpenAI Codex**: Update to version **0.146.0** or later.
### Workarounds
- Limit the use of third-party, unverified plugins.
- Monitor outbound network traffic from AI coding agents for suspicious destinations.
- Use agents in sandboxed containers or isolated development environments.
## Detection
- **Indicators of Compromise**: Unexpected behavior in the AI agent, unauthorized file modifications, or requests to unknown external IPs/domains.
- **Detection Methods**: Audit plugin installation logs to check if installed hashes match expected upstream hashes (where possible).
## References
- **Vendor Advisory**: Anthropic Security Updates (hXXps[://]www[.]anthropic[.]com/security)
- **Vendor Advisory**: OpenAI Security (hXXps[://]openai[.]com/security)
- **Research Firm**: Air Security (hXXps[://]air[.]security)