Plugin4Shell: Zero-click RCE hits four major AI coding agents — how to fix

TL;DR

If you searched for "Plugin4Shell vulnerability" or "AI coding agent security flaw": on September 18, 2026, security firm AIR disclosed Plugin4Shell, a zero-click RCE vulnerability affecting Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI. The flaw breaks SHA pinning in plugin auto-update mechanisms, letting attackers swap in malicious code with no user action. As of disclosure, Claude Code and Codex are patched, Copilot remains unpatched, and Google deprecated Gemini CLI entirely.

Affected Agents and Fix Status

Gemini CLI users are advised to migrate to Google's newer agent, Antigravity, which does not use the plugin pinning system. Existing Gemini CLI installs remain exposed indefinitely.

How the Vulnerability Works

SHA Pinning Mechanism

When a developer installs a plugin, the agent locks to a specific commit SHA (hash) of the plugin's code. In theory, once pinned, the code cannot change without the developer's knowledge.

The Bypass

Plugin4Shell exploits a basic Git behavior: branches can be named with hex-like strings. When the agent checks out the pinned commit, it does not verify the checkout actually landed on the target commit:

1. Attacker names a branch as a 40-hex-character string (mimicking a commit SHA)
2. The agent's git checkout matches the branch name instead of the commit hash
3. Malicious code is checked out via the branch, but pinning verification still shows SHA match

GitHub rejects 40-hex branch names, but Bitbucket and self-hosted Git servers allow them.

Zero-Click Property

This is not an install-time bug. Claude Code and Codex default to background auto-updates for installed plugins. When the marketplace pushes a new pinned SHA, the swap reaches all installed users automatically — no user action required.

Two Attack Paths

Path 1: Malicious Plugin Publication

An attacker publishes a plugin that works exactly as advertised, passes review, and gets adopted. Later, they use Plugin4Shell to turn it malicious. AIR previously validated this path: a test plugin spread to over 26,000 agents before being pulled.

Path 2: Repository Hijacking (SkillJacking)

An attacker takes over an existing plugin's repository (original maintainer gone), then uses the same bypass to push malicious code to all installed users. AIR found 925 skills already hijacked, reaching 134,000 agents.

Developer Action Plan

If you use Claude Code

• Upgrade to version 2.1.179 or later
• Audit installed plugins, remove untrusted sources

If you use OpenAI Codex

• Upgrade to version 0.146.0 or later
• Same plugin audit as above

If you use GitHub Copilot

• Microsoft has not shipped a fix — no patch available
• Pause new plugin installs, audit existing ones
• Watch Microsoft security advisories for a patch

If you use Gemini CLI

• Google deprecated the tool, no fix coming
• Migrate to Antigravity or another agent
• Existing installs stay exposed — stop using immediately

Supply Chain Security Lessons

Plugin4Shell is the first disclosed supply chain vulnerability in the AI agent ecosystem. It exposes a systemic issue: when multiple agents share the same trust model (SHA pinning), one underlying flaw hits the entire ecosystem at once.

Researchers recommend: agent vendors should implement checkout verification in the agent itself (not the marketplace), since no marketplace can guarantee protection alone.

Next Steps

1. Check your AI coding agent version against the table above
2. Audit all installed plugins for source and maintainer status
3. Temporarily disable plugin auto-updates for critical projects
4. Follow AIR's official blog for updates

Related: how to add quality gates to AI automation workflows at /ai-agent-tutorials.