Skip to content
NewsIncident

Plugin4Shell Zero-Click RCE Hits All Four Major AI Coding Agents; Claude Code and Codex Patched, GitHub Copilot and Gemini CLI Still Exposed

· by Pondero Newsdesk

The short version

AIR Security disclosed Plugin4Shell on September 17, 2026: a zero-click RCE that bypasses SHA-pinning across Claude Code, Codex, GitHub Copilot, and Gemini CLI. Two agents are patched. Two are not.

Plugin4Shell Zero-Click RCE Hits All Four Major AI Coding Agents; Claude Code and Codex Patched, GitHub Copilot and Gemini CLI Still Exposed

SHA pinning is the security model the AI coding-agent ecosystem built to stop plugin-based supply-chain attacks. Plugin4Shell proves it can be bypassed at the client level, no matter how carefully a marketplace pins its commits. AIR Security disclosed the vulnerability on September 17, 2026. Claude Code and OpenAI Codex have patches. GitHub Copilot has none. Google deprecated Gemini CLI rather than fix it.

What happened

The vulnerability affects the plugin-loading path shared by Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI, per AIR Security's disclosure. Each agent lets users install plugins from marketplaces, and each marketplace pins plugins to a specific reviewed commit using a 40-character git SHA. The pin is supposed to guarantee that code running locally matches code that passed review.

Plugin4Shell breaks that guarantee. An attacker who controls a plugin's repository can create a branch whose name is the same 40-hex string as the pinned SHA. When the agent's installer runs git checkout <pinned-sha>, git resolves the reference to the branch rather than the commit, because git prefers named refs over bare object IDs when both exist. The working tree becomes attacker-controlled, yet the agent reports a successful install at the pinned SHA, per the disclosure.

The zero-click element comes from background auto-update. Claude Code and Codex update installed plugins by default without user prompts. When a marketplace bumps the pinned SHA to a new version, the agent re-runs the same checkout, which again resolves to the attacker's branch, silently replacing a previously trusted plugin. No user action is required at any step.

Gemini CLI has a distinct variant. Its installer fetches the pinned commit, then runs git checkout FETCH_HEAD. If the repository's default branch is named "FETCH_HEAD," the checkout resolves to that branch rather than the fetched commit, and the fetched content is silently discarded, per the disclosure.

AIR Security researchers Or Nevo, Dor Granat, and Niv Hoffman found Plugin4Shell in May 2026, disclosed it to all four vendors in June 2026, and published publicly on September 17, 2026.

Patch status

Claude Code version 2.1.179 contains Anthropic's fix, confirmed on June 17, 2026, per AIR Security. Users still running earlier versions should update before using plugin-based workflows. OpenAI patched Codex in version 0.146.0, verified fixed on August 12, 2026.

GitHub Copilot has no patch. Microsoft received the disclosure in June 2026 and has not shipped a fix. Copilot users have no available mitigation beyond removing plugins entirely until a patch ships.

Gemini CLI will not be patched. Google deprecated the CLI and told AIR Security it would not issue a fix. The disclosure advises Gemini CLI users to migrate to Antigravity, a replacement agent that does not implement the same plugin SHA-pinning model, per AIR Security.

The fix that closes both variants is a single assertion inside the agent: after checkout, resolve the commit actually present in the working tree and abort if it does not equal the pinned SHA. Per the disclosure: test "$(git rev-parse HEAD)" = "<pinned-sha>" || abort. That check must run inside the agent because the pin resolves on the client side, not at the marketplace.

Why it matters for developers using these tools

Developers who run Claude Code or Codex and have not yet updated face potential silent compromise of any plugin-enabled workflow. The attack requires only that a trusted plugin be installed; the victim does not need to install anything new. Once the attacker controls the upstream repository and the marketplace bumps the pinned SHA, the malicious version deploys on the next background update cycle.

For teams that went beyond community marketplaces, reviewed plugins, and pinned them to reviewed commits, the news is worse: the SHA-pinning process they relied on does not deliver the guarantee it appears to deliver. Vetting code at one commit and pinning to that commit does not protect against Plugin4Shell, because the checkout can resolve to a different tree than the commit that was reviewed.

Developers on GitHub Copilot should treat plugin auto-updates as an active risk vector until Microsoft issues a patch. There is no timeline on record.

Context

Plugin4Shell is the third supply-chain disclosure in a series from AIR Security targeting AI agent ecosystems. An earlier paper, "The Story of Skills," demonstrated building a malicious skill, publishing it to a trusted marketplace, and seizing control of over 26,000 agents. The subsequent "SkillJacking" disclosure showed that 925 already-deployed skills could be hijacked by taking over their underlying repositories, affecting 134,000 agents, per AIR Security.

SHA pinning was the industry's response to SkillJacking: lock plugins to a reviewed commit so that repository-takeover attacks cannot install new code. Plugin4Shell is the paper that shows this response is insufficient. The bypass works at the client level, inside each agent's checkout logic. No marketplace-side change can restore the guarantee, which is why a coordinated disclosure to all four vendors was necessary and why GitHub Copilot users are left without a mitigation path while Microsoft's fix is in progress.

AIR Security noted that enterprises using its own Air Marketplace and Air Filter products were not affected by Plugin4Shell.

What to watch next

The most pressing open question is Microsoft's patch timeline for GitHub Copilot. The disclosure was made in June 2026, went public in September 2026, and no fix date has been stated. Given Copilot's install base, this is the largest unresolved exposure. Second: whether any Gemini CLI deployments are exploited before users complete the migration to Antigravity. Google has no patch path, and not every team will migrate quickly. Third: whether the broader plugin ecosystem (MCPs, IDE extensions, agent frameworks beyond these four) adopts post-checkout SHA verification as a standard step, given that the flaw appeared independently across four separate codebases.

Sources