Plugin4Shell: zero-click RCE hits Claude Code, Codex, Copilot, and Gemini CLI
If you use any major AI coding agent, you are operating in a window that security researchers are calling a first-of-its-kind AI supply-chain attack surface. The exploit is named Plugin4Shell, and it delivers zero-click remote code execution across Claude Code, OpenAI Codex, Google Gemini CLI, Microsoft Copilot, and GitHub Copilot.
What the Vulnerability Does
Plugin4Shell targets the SHA-pinning mechanism that coding agents use to lock plugins to a specific, immutable commit hash. The idea behind SHA-pinning is sound: even if a public plugin repository gets compromised, your agent keeps running the audited code it originally pinned rather than pulling a new, malicious payload.
The problem, according to researchers Or Nevo, Dor Granat, and Niv Hoffman at security startup Air, is that agents check out the pinned commit but never verify they actually landed there. An attacker who controls the plugin repository can make the checkout resolve to malicious code while the pin still appears honored.
Because Claude Code and Codex auto-update installed plugins by default, no user interaction is required. The agent pulls the malicious version on its own.
Two Attack Paths
- Bait and switch: An attacker submits a clean plugin to a trusted marketplace, waits for it to pass review, then replaces the content with malicious code after the fact.
- Repository hijacking: An attacker takes over a legitimate author’s repository and pushes the malicious version to every agent that already has it installed, bypassing the SHA-pinning safety net entirely.
The Air team says their earlier SkillJacking and RepoJacking proof-of-concept attacks demonstrate takeovers at scale. Plugin4Shell defeats the mechanism that was supposed to contain them.
Patch Status by Vendor
Air reported the flaw to all four vendors in June. The patch situation is uneven:
- Anthropic: Patched in Claude Code
2.1.179 - OpenAI: Patched in Codex
0.146.0 - Google: Deprecated Gemini CLI and will not patch it. Google recommends migrating to its newer Antigravity agentic development environment, which is not affected.
- Microsoft Copilot: No patch shipped. Microsoft had not responded to Air’s disclosure as of the researchers’ report, which Air attributed to the volume of disclosures Microsoft is currently handling.
- GitHub Copilot: GitHub says Plugin4Shell cannot be exploited on GitHub because the platform blocks branch and tag names that resemble commit SHAs. Air disputes that this is sufficient, noting that marketplaces can also be hosted on other platforms such as Bitbucket, and that Microsoft Copilot supports those platforms as well.
Microsoft did not respond to The Register’s request for comment. According to Microsoft’s own figures, nearly 90 percent of Fortune 500 companies use Copilot.
What to Do Now
The Air researchers are direct: the fix has to ship in the agent, and updating is the only complete mitigation where one exists. If you are on Claude Code or Codex, update immediately to the patched versions. If you are running Gemini CLI, migrate to Antigravity. If you are on Microsoft Copilot, there is no patch available yet.
I’m founder of BizStack at Cagri Sarigoz LLC and a passionate advocate for entrepreneurs.
With over 14 years in tech, marketing, and AI, including my role as Head of SEO at CitizenShipper and co-founder of TaleBot at Intale AI, I’m dedicated to sharing genuine, useful product insights and tips.
At BizStack, I aim to cut through the digital noise to provide clear, actionable advice.
And more than all else, I’m a father to a (always) little girl and a husband.
Contact me at [email protected] for assistance.
