Plugin4Shell: zero-click RCE hits Claude Code, Codex, Copilot, Gemini CLI
If you use an AI coding agent and install plugins from a marketplace, this one is worth understanding before you read the rest of your feed today.
Researchers Or Nevo, Dor Granat, and Niv Hoffman at Air Security published a vulnerability called Plugin4Shell. It hits Claude Code, OpenAI Codex, GitHub Copilot, and Google Gemini CLI. The researchers classify it as zero-click remote code execution: the victim does not have to do anything for the attack to land.
How the exploit works
Coding agent marketplaces pin each plugin to a specific commit hash, a 40-character string that identifies one exact snapshot of reviewed code. The assumption was that pinning the hash locks the code permanently. The agents check out that hash and run it.
The problem: the agents verify the hash they asked for but not the code they actually received. Git lets a branch carry any name, including a string that looks identical to a commit hash. When a name is both a valid branch and a valid object, git silently resolves to the branch. An attacker who controls a plugin repository can create a branch named after the pinned hash, point it at malicious code, and set it as default. The agent checks it out, installs the attacker’s payload, and reports a clean install at the expected hash.
The Gemini CLI variant is slightly different. It fetches the correct commit, then runs a checkout that a branch named FETCH_HEAD can intercept. The legitimate code never reaches disk.
Why no one has to click anything
Claude Code and Codex refresh installed plugins automatically in the background by default. An attacker does not need a developer to install anything new. The sequence Air describes: publish something useful, pass review, gather users, ship a routine update so the marketplace re-pins to a new commit hash, then create a branch named after that new hash loaded with malicious code. Every auto-update does the rest.
A swapped plugin runs with the same system access as the developer using the agent. That means files, stored credentials, and every system that developer can log in to are in scope. OWASP flagged the same underlying problem in its 2026 top ten, placing excessive agency at number three.
Patch status
| Agent | Status | Version |
|---|---|---|
| Claude Code | Patched | 2.1.179 |
| OpenAI Codex | Patched | 0.146.0 |
| GitHub Copilot | No fix shipped | N/A |
| Gemini CLI | Will not be fixed (retiring) | N/A |
Google is retiring the Gemini CLI entirely and pointing users toward Antigravity, which has no plugin pinning to bypass. Microsoft has not responded publicly and has shipped no patch. Roughly 90 percent of Fortune 500 companies use Copilot, according to Microsoft’s own figures.
️ How narrow the real-world risk is
The Hacker News checked default marketplaces on 18 September and found every plugin in Anthropic’s community catalogue and the default catalogues for both Claude Code and Copilot points to a GitHub repository. GitHub rejects branch names shaped like commit hashes, which blocks the hash-spoofing variant there. GitHub says its users are not exposed for that reason.
Air pushes back on that framing. Marketplaces can be hosted on Bitbucket or a company’s own git server, both of which allow hash-shaped branch names. Anthropic’s documentation lists those hosts as valid marketplace backends, and Copilot supports them too. Developers who install only from the default GitHub-hosted catalogues are not directly exposed to the branch-name trick, but teams running internal or third-party marketplaces on non-GitHub infrastructure are.
The Gemini CLI’s FETCH_HEAD variant is a separate concern. GitHub’s rule does not clearly block that branch name, and the Gemini CLI will never receive a fix.
Four months, no CVE
Air built a working proof of concept in May and disclosed to all four vendors in June. Anthropic confirmed its fix on 17 June. Google announced on 4 August that no fix would ship. Codex was verified fixed on 12 August. As of 18 September, no CVE has been assigned and no vendor has published a security advisory. Anthropic’s release notes for version 2.1.179 do not mention the fix. Air’s post is the only public record that it exists.
No evidence of exploitation in the wild has been reported. This is the third time Air has demonstrated a meaningful attack through the AI plugin supply chain: an earlier campaign planted a malicious skill that reached about 26,000 agents, and a follow-on took over 925 existing skills affecting 134,000 agents. SHA pinning was the fix the industry agreed on after those incidents. Plugin4Shell is what happens when the pinning check runs but the verification does not.
The fix is one line of code: after checkout, resolve what is actually in the working tree and abort if it does not match the pin. Whether a plugin that was already swapped before patching gets cleaned up on update is not addressed in any vendor communication published so far.
I’m founder of BizStack at Cagri Sarigoz LLC and a passionate advocate for entrepreneurs.
With over 14 years in tech, marketing, and AI, including my role as Head of SEO at CitizenShipper and co-founder of TaleBot at Intale AI, I’m dedicated to sharing genuine, useful product insights and tips.
At BizStack, I aim to cut through the digital noise to provide clear, actionable advice.
And more than all else, I’m a father to a (always) little girl and a husband.
Contact me at [email protected] for assistance.
