Threat · curated 17 Sep 2026
Plugin4Shell - Zero Click RCE Vulnerability found in top 4 most popular coding agents, millions of agents affected
First reported air.security
Coverage timeline
Single-source incident — first reported, latest, and curated coincide.
Why it matters
Plugin4Shell weaponizes trusted plugin marketplaces to achieve zero-click RCE across the most widely deployed AI coding agents, meaning millions of developer machines and enterprise assets can be compromised through the AI supply chain - and several vendors remain unpatched.
Researchers at Air disclosed "Plugin4Shell," a zero-click remote code execution vulnerability affecting all four major AI coding agents - Anthropic's Claude Code, OpenAI's Codex, Google's Gemini CLI, and Microsoft's Copilot/GitHub Copilot. The AI supply-chain attack silently swaps a trusted plugin in agent marketplaces for a malicious one that auto-installs past the agent's SHA pinning, potentially giving attackers full access to every asset and data the agent can reach. Anthropic and OpenAI patched it (Claude Code 2.1.179, Codex 0.146.0), while Google deprecated Gemini CLI and Microsoft did not fix Copilot.
Summary
Researchers at the AI-security startup Air disclosed 'Plugin4Shell,' a zero-click, high-severity remote code execution vulnerability affecting the four most popular AI coding agents - Anthropic's Claude Code, OpenAI's Codex, Google's Gemini CLI, and Microsoft's Copilot (as well as GitHub Copilot). The flaw is described as a plugin SHA-pinning bypass that defeats the very mechanism intended to stop plugin supply-chain attacks.[0][2]
Because agents automatically update installed plugins, an attacker who controls a plugin's repository can silently swap a pinned commit for malicious code, achieving zero-click code execution with access to everything the agent can reach. The disclosure is characterized as a proof-of-concept-backed 'first-of-its-kind AI supply-chain attack' rather than observed in-the-wild exploitation.[0][2]
Patch status is fragmented: Anthropic and OpenAI shipped fixes, Google declined to patch a deprecated Gemini CLI, and Microsoft did not fix Copilot, meaning meaningful populations of agents remain vulnerable.[0]
Attack chain
- Plugin submission or repository takeover: An attacker either submits a benign plugin to a trusted marketplace that passes review, or hijacks a legitimate author's plugin repository, using techniques the researchers demonstrated as SkillJacking and RepoJacking.[0]
- Malicious commit swap past SHA pinning: The attacker replaces the pinned upstream commit with malicious code. The agent checks out the pinned commit but never verifies it actually resolved to the audited hash, so the checkout resolves to attacker code while the SHA pin still appears honored.[0]
- Zero-click auto-update and RCE: Because Claude Code and Codex auto-update installed plugins by default, the malicious version is pulled and executed without user interaction, giving the attacker full access to every asset and data the agent can reach.[0]
Disclosure timeline
| Date | Event |
|---|---|
| June 2026 | Air reported the vulnerability to all four vendors (Anthropic, OpenAI, Google, Microsoft).[0] |
| September 17, 2026 | Air published the Plugin4Shell report; The Register covered the disclosure the same day.[0][2] |
How it works
Marketplaces enforce SHA-pinning to lock agent plugins and skills to a specific immutable commit hash rather than a mutable reference like a version tag or branch, so a compromised repository will not cause the agent to pull new malicious payloads.[0]
The vulnerability is a plugin SHA-pinning bypass: the agent checks out the exact commit the marketplace pinned but never verifies that the checkout landed on that commit. An attacker who controls the plugin's repository can make the checkout resolve to malicious code while the pin still looks honored, producing zero-click RCE.[0]
The zero-click property comes from agents' default plugin auto-update behavior: when a pinned commit is swapped upstream, the agent's plugin is replaced with a malicious version without user action. Both Claude Code and Codex auto-update installed plugins by default.[0]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| Anthropic Claude Code | Versions before 2.1.179 | Patched in Claude Code 2.1.179[0] |
| OpenAI Codex | Versions before 0.146.0 | Patched in Codex 0.146.0[0] |
| Google Gemini CLI | All installs | Will not be patched (deprecated); Google recommends migrating to Antigravity, which is protected[0] |
| Microsoft Copilot | Vulnerable, including via marketplaces hosted on platforms such as Bitbucket | Not fixed[0] |
| GitHub Copilot / GitHub | GitHub states it is not affected due to blocking branch/tag names that resemble commit SHAs; Air disputes that this fully mitigates Plugin4Shell | GitHub applies a name-restriction mitigation; Air considers it insufficient[0] |
Key takeaways
- Plugin4Shell defeats the SHA-pinning mechanism built to contain plugin supply-chain attacks, showing that pinning a commit hash is meaningless if the agent never verifies the checkout actually resolved to that hash.[0]
- Default plugin auto-update turns a repository takeover into a zero-click compromise, so agentic tooling that auto-pulls plugins expands the supply-chain blast radius across millions of installs.[0][2]
- Fragmented vendor response - two vendors patched, one deprecated its tool without a fix, and one did not fix - means large populations of coding agents remain exposed even after disclosure.[0]
Defensive actions
- Update affected agents to patched versions.: The researchers state the fix must ship in the agent and that updating is the only complete mitigation where one exists; Anthropic fixed Claude Code 2.1.179 and OpenAI fixed Codex 0.146.0.[0]
- Migrate off the deprecated Gemini CLI to Google Antigravity.: Google will not patch the deprecated Gemini CLI, so every install remains vulnerable, but Antigravity is protected from this attack.[0]
- Treat marketplace SHA-pinning as insufficient on its own and account for exposure via alternative hosting platforms.: Air warns that mitigations restricted to a single platform (e.g., GitHub's SHA-name blocking) do not close the vulnerability because marketplaces can be hosted on platforms such as Bitbucket, keeping Microsoft Copilot exposed.[0]