Plugin4Shell: zero-click RCE hit Claude Code, Codex, and Copilot
If your team runs AI coding agents with third-party plugins, this one needs to move to the top of your patch queue.
Researchers at cybersecurity startup AIR disclosed a vulnerability they are calling Plugin4Shell: a zero-click remote code execution flaw affecting Claude Code, OpenAI Codex, GitHub Copilot, and Google’s Gemini CLI. No developer interaction required. An attacker who controls a plugin repository can execute malicious code inside your development environment just by swapping out what the agent thinks is a trusted, reviewed plugin.
How the Attack Works
AI coding agents use Git SHA hashes to verify that a plugin is running the approved, reviewed commit. The agent tells Git to check out the commit matching that SHA. The flaw is that the agent never confirms Git actually checked out the right commit afterward.
That gap lets an attacker who controls the plugin repository create a malicious version and name it to match the legitimate SHA. When the agent asks Git to resolve that SHA, Git returns the attacker-controlled code instead. The agent runs it, none the wiser.
Gemini CLI had a slight variation on the same root problem. After fetching the legitimate commit via SHA, Gemini CLI tells Git to check out the code using the name FETCH_HEAD. An attacker can create a malicious plugin version with that same name, which Git returns when Gemini CLI requests the checkout.
Patch Status Right Now
- Claude Code: Fixed in version
2.1.179 - OpenAI Codex: Fixed in version
0.146.0 - Gemini CLI: Google deprecated Gemini CLI and is directing users to migrate to Antigravity. No fix will be issued.
- GitHub Copilot: No patch released as of the disclosure date. GitHub told The Register it applied naming restrictions on tags that resemble commit SHAs, but AIR researchers noted that plugins can be hosted on other platforms like Bitbucket, where those restrictions do not apply.
What’s at Risk in an Enterprise Environment
AI coding agents typically run with the same access permissions as the developer who installed them. That means a compromised plugin could reach source code, API keys, cloud credentials, and CI/CD pipelines, according to Pareekh Jain, principal analyst at Pareekh Consulting.
“Enterprises using AI coding agents with third-party plugins are likely to be most exposed, especially when those agents have access to source code, credentials, cloud systems or CI/CD tools as these plugins mostly run with the same access the developer or employee has.”
What to Check Right Now
- Update Claude Code to
2.1.179or later and Codex to0.146.0or later immediately - Audit machines running affected agents for unusual processes, unexpected plugin files, and suspicious Git activity
- Review EDR, Git, CI/CD, cloud IAM, and authentication logs for anomalies
- Check whether your agents are set to update automatically
- If you use Gemini CLI, treat migration to Antigravity as urgent rather than optional
AIR researchers noted this is a flaw no plugin marketplace can fix on its own. The verification logic lives in the agent itself, which means vendor patches are the only real solution. Enterprises can add controls around plugin usage, but they cannot fix how the agent validates the code it checks out.
The vulnerability was first discovered in May and disclosed to vendors in June.
I’m founder of BizStack at Cagri Sarigoz LLC and a passionate advocate for entrepreneurs.
With over 14 years in tech, marketing, and AI, including my role as Head of SEO at CitizenShipper and co-founder of TaleBot at Intale AI, I’m dedicated to sharing genuine, useful product insights and tips.
At BizStack, I aim to cut through the digital noise to provide clear, actionable advice.
And more than all else, I’m a father to a (always) little girl and a husband.
Contact me at [email protected] for assistance.
