Threat
Plugin4Shell - Zero Click RCE Vulnerability found in top 4 most popular coding agents, millions of agents affected
Publication date not yet evaluated · Added · 5 reports air.security
Page published · Page updated
Coverage timeline
Why it matters
Plugin4Shell is described as the first supply-chain vulnerability of the AI agent ecosystem, giving attackers employee-level reach into systems even for users who installed only reviewed, pinned plugins from trusted marketplaces.
Researchers at AIR disclosed Plugin4Shell (CVE-2026-94127), a zero-click RCE affecting four major AI coding agents - Claude Code, Codex, GitHub Copilot and Gemini CLI - that bypasses plugin SHA pinning by checking out a pinned commit without verifying the checkout landed there, letting a repository owner swap in malicious code while the pin still looks intact. Because the same git checkout re-runs on background auto-update, malicious code reaches already-installed, reviewed plugins with no user action; AIR notes related SkillJacking research hijacked 925 skills reaching 134,000 agents. Fixes are available for Claude Code and Codex while two agents reportedly remain unpatched.
Summary
Security firm AIR disclosed 'Plugin4Shell,' a plugin SHA-pinning bypass affecting four widely used AI coding agents - Anthropic Claude Code, OpenAI Codex, GitHub Copilot, and Google Gemini CLI. Marketplaces pin each plugin to a specific reviewed commit hash, but every one of the four agents checks out that commit without verifying the checkout actually landed there, letting an attacker swap in malicious code while the pin still appears intact.[0][5]
Because a swapped plugin runs with the same reach as the employee running the agent, it can access that user's systems and data. AIR frames this as a zero-click, high-severity RCE: the same git checkout re-runs on background auto-update - the default in Claude Code and Codex - so a bumped pinned SHA reaches already-installed plugins with no user action. The branch-name variant used for Claude Code, Codex and Copilot requires a host that permits branch names shaped like a hash; GitHub rejects 40-hex branch names, but Bitbucket and self-hosted servers allow them. Gemini CLI is exposed through a separate fetch/checkout mechanism.[0][5]
This is proof-of-concept-backed research rather than observed in-the-wild exploitation, though AIR says the end-to-end chain is proven at scale through its earlier work (a plugin reaching more than 26,000 agents and SkillJacking hijacking 925 skills across 134,000 agents). Vendor response is fragmented: Anthropic patched Claude Code 2.1.179 and OpenAI patched Codex 0.146.0, while Microsoft has shipped no fix for Copilot and Google deprecated Gemini CLI, directing users to Antigravity. Because the check runs inside the agent rather than at the marketplace, updating the agent is the only complete fix.[0]
Attack chain
- Repository control or takeover: The attacker either publishes a plugin that works as advertised, passes review and is adopted before being turned malicious, or takes over the repository behind a plugin that users already trust. AIR demonstrated both: a benign-then-malicious plugin reaching over 26,000 agents and SkillJacking takeovers of 925 skills reaching 134,000 agents.[0]
- SHA-pinning bypass: On a host that permits branch names shaped like a commit hash (git's default; allowed by Bitbucket and self-hosted servers, blocked by GitHub for 40-hex names), the owner points a hash-shaped branch at different code. The agent checks out the pinned commit but never verifies the checkout landed there, so it materializes attacker code while the pin still looks intact. Gemini CLI is subverted via a separate fetch/checkout mechanism with the same outcome.[0]
- Zero-click delivery via auto-update: The same git checkout re-runs on background auto-update - the default in Claude Code and Codex - so when the marketplace bumps the pinned SHA, the swapped code reaches already-installed plugins with no user action.[0]
- Code execution with user privileges: The swapped plugin runs with the same reach into company systems and data as the employee running the agent.[0]
Disclosure timeline
| Date | Event |
|---|---|
| May 2026 | AIR found the bug and built working proof-of-concept exploits against all four agents.[0] |
| June 2026 | AIR disclosed the vulnerability to each vendor (the month after discovery).[0] |
| September 17, 2026 | AIR published the Plugin4Shell disclosure (authors Or Nevo, Dor Granat, Niv Hoffman).[5] |
| September 18, 2026 | Help Net Security reported on the disclosure and the uneven vendor response.[0] |
How it works
Marketplaces use SHA pinning to lock an installed plugin to a specific, reviewed commit, so a plugin cannot change after review without the developer's knowledge. The vulnerability is that every one of the four agents checks out the pinned commit without verifying the checkout actually landed on it.[0]
For Claude Code, Codex and GitHub Copilot, the bypass is tied to how git handles branch names: a branch can be named to look like a commit hash and pointed at different code, so the agent resolves to attacker code while still reporting the locked version. This only works where a host permits hash-shaped branch names - git's default - which Bitbucket and self-hosted git servers allow but GitHub forbids for 40-hex names. Gemini CLI is exposed through a separate mechanism in how it fetches and checks out pinned commits, with the same outcome.[0]
The issue is zero-click because the same git checkout re-runs on background auto-update, which is the default in Claude Code and Codex, so when the marketplace bumps the pinned SHA the swap reaches already-installed plugins without user action. Since the check runs inside the agent rather than at the marketplace, no marketplace can guarantee the protection on its own and each vendor must fix it in the agent itself.[0]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| Anthropic Claude Code | Versions before 2.1.179 | Patched in 2.1.179 following AIR's disclosure[0] |
| OpenAI Codex | Versions before 0.146.0 | Patched in 0.146.0[0] |
| GitHub Copilot | Vulnerable to the same flaw | No fix shipped by Microsoft; users left with no patch[0] |
| Google Gemini CLI | Vulnerable via a separate fetch/checkout mechanism | Will not be fixed; Google deprecated Gemini CLI and advises moving to Antigravity, which is built without the plugin pinning system this attack relies on[0] |
Indicators of Compromise
| Type | Indicator | Context |
|---|---|---|
| cve | CVE-2026-94127 | CVE identifier referenced for the Plugin4Shell AI coding-agent SHA-pinning bypass vulnerability.[36] |
Key takeaways
- Pinning a plugin to a commit hash is meaningless if the agent never verifies the checkout actually resolved to that hash; git can interpret a requested SHA as a branch name and materialize different code while the pin still looks honored.[0]
- Zero-click exposure is amplified by background auto-update, the default in Claude Code and Codex, which re-runs the vulnerable checkout and pushes swapped code to already-installed plugins without user action.[0]
- The protection cannot be fixed at the marketplace level; each vendor must patch its own agent, and the response is fragmented - two agents patched, one (Copilot) unfixed, and one (Gemini CLI) deprecated rather than patched.[0]
- AIR argues the attack chain is proven end to end, pairing Plugin4Shell with its demonstrated takeovers at scale (a plugin reaching over 26,000 agents and SkillJacking hijacking 925 skills across 134,000 agents), though these are the researchers' demonstrations rather than observed in-the-wild attacks.[0]
Defensive actions
- Update Claude Code to 2.1.179 or later and Codex to 0.146.0 or later.: The fix must ship inside each agent because the pinning check runs in the agent on the user's machine, not at the marketplace; Anthropic and OpenAI shipped fixes in these versions, and updating is described as the only complete fix.[0]
- Move off the deprecated Gemini CLI to Antigravity.: Google deprecated Gemini CLI rather than patching it, leaving every existing install exposed indefinitely; Antigravity is built without the plugin pinning system this attack relies on.[0]
- Treat unpatched GitHub Copilot as exposed and scrutinize plugins installed from hosts that permit hash-shaped branch names.: Microsoft has not shipped a fix for Copilot, and the branch-name trick works on hosts such as Bitbucket and self-hosted git servers (unlike GitHub, which rejects 40-hex branch names).[0]
Changelog
- A CVE identifier, CVE-2026-94127, is now referenced for the vulnerability, whereas the prior assessment recorded that no CVE had been assigned.[36]
- Added AIR's scale evidence for the attack chain - a benign-then-malicious plugin reaching over 26,000 agents and the SkillJacking takeover of 925 skills reaching 134,000 agents - not present in the prior assessment.[0]
- Clarified the vendor response from AIR's primary framing: Microsoft has shipped no Copilot fix and Google deprecated Gemini CLI (advising migration to Antigravity) rather than patching.[0]