Plugin4Shell: zero-click RCE hits Claude Code, Codex, Copilot, Gemini CLI
Security researchers at AIR have disclosed a zero-click remote code execution vulnerability affecting Claude Code, Codex, GitHub Copilot, and Gemini CLI. They’re calling it Plugin4Shell, and they describe it as the first supply chain vulnerability of the AI agent ecosystem.
How the Attack Works
The bug breaks SHA pinning, the mechanism that locks an installed plugin to a specific, reviewed version of its code. Every one of the four agents checks out the pinned commit without verifying the checkout actually landed there. An attacker can swap in malicious code while the pin still looks intact.
What makes it zero-click: the same git checkout re-runs on background auto-update, which is the default behavior in both Claude Code and Codex. When a marketplace bumps the pinned SHA, the malicious swap reaches already-installed plugins with no action required from the user.
Claude Code, Codex, and GitHub Copilot share one version of the bypass, tied to how git handles branch names. Gemini CLI is exposed through a separate mechanism in how it fetches and checks out pinned commits. The outcome is the same either way.
The flaw works on git hosts that allow a branch to be named like a hash. GitHub blocks 40-hex branch names outright. Bitbucket and self-hosted git servers allow them.
Proven at Scale
AIR demonstrated two attack paths. In the first, a researcher-built plugin spread to more than 26,000 agents before being pulled. In the second, a separate piece of research called SkillJacking found 925 skills already in active use had been hijacked from their original maintainers, reaching 134,000 agents.
“Together, the chain is proven end to end: takeovers happen at scale, and Plugin4Shell defeats the mechanism built to contain them.”
Who Patched and Who Didn’t
AIR found the bug in May 2026, built working proof-of-concept exploits against all four agents, and disclosed it to each vendor the following month. The response has been uneven:
- Anthropic patched Claude Code in version
2.1.179. - OpenAI patched Codex in version
0.146.0. - Microsoft has not shipped a fix for GitHub Copilot. No patch exists for those users today.
- Google deprecated Gemini CLI entirely instead of patching it. Every existing install stays exposed. Google’s guidance is to migrate to its newer agent, Antigravity, which does not use the plugin pinning system this attack relies on.
AIR noted that no marketplace can close this gap on its own because the vulnerable check runs inside the agent itself. A fix requires each vendor to update the agent. If you’re running an unpatched version of Copilot or haven’t migrated off Gemini CLI, there is no workaround short of removing the affected plugins.
I’m founder of BizStack at Cagri Sarigoz LLC and a passionate advocate for entrepreneurs.
With over 14 years in tech, marketing, and AI, including my role as Head of SEO at CitizenShipper and co-founder of TaleBot at Intale AI, I’m dedicated to sharing genuine, useful product insights and tips.
At BizStack, I aim to cut through the digital noise to provide clear, actionable advice.
And more than all else, I’m a father to a (always) little girl and a husband.
Contact me at [email protected] for assistance.
