AI Coding Agents Face Critical Plugin4Shell RCE Flaw Bypassing SHA-Pinning Security

Critical Zero-Click Vulnerability Exposes AI Coding Agents

A zero-click remote code execution vulnerability affecting all major AI coding agents has been disclosed by Air Security researchers, threatening enterprise systems with unprecedented access to sensitive data and infrastructure1

1

. The flaw, dubbed Plugin4Shell, impacts Anthropic Claude Code, OpenAI Codex, Google Gemini CLI, GitHub Copilot, and Microsoft Copilot, potentially reaching millions of users across organizations that rely on these AI coding agents for development workflows2

2

.

Air Security researchers Or Nevo, Dor Granat, and Niv Hoffman discovered this first-of-its-kind AI supply-chain attack in May and reported it to all four vendors in June3

3

. The vulnerability represents a fundamental flaw in how AI coding agents enforce security mechanisms designed to protect against supply chain attacks, making it a critical concern for the approximately 90 percent of Fortune 500 companies using Copilot1

1

.

How Plugin4Shell Bypasses SHA-Pinning Mechanisms

The RCE vulnerability exploits a critical gap in how AI coding agents verify plugins from trusted plugin marketplaces. When developers install plugins to extend agent capabilities, these tools typically use a commit hash—a unique cryptographic identifier generated by secure hash algorithm (SHA)—to lock plugins to specific, reviewed versions2

2

. This SHA-pinning mechanism exists specifically to prevent supply chain attacks by ensuring agents run only audited code rather than automatically pulling potentially malicious updates.

However, Plugin4Shell defeats this protection through a plugin SHA-pinning bypass. The vulnerability in AI coding agents stems from a fundamental verification failure: while agents pass the SHA directly to Git to check out plugin code, they never verify that Git actually checked out the commit corresponding to that SHA1

1

. Repository owners who control a plugin's code can exploit this by creating branches or tags with names resembling commit hashes, effectively tricking the agent into installing malicious code while maintaining the appearance of using the pinned, trusted version3

3

.

OpenAI's public fix documentation confirms the underlying issue, stating that Git "can interpret a requested commit SHA as a branch name," which allows a plugin source to "materialize a different commit than the one it pinned"3

3

. This creates a scenario where the agent checks out the exact commit the marketplace pinned but never verifies it landed there, resulting in zero-click remote code execution when attackers swap pinned plugin code upstream1

1

.

Attack Vectors and Enterprise Exposure

Air Security identified two primary attack scenarios for exploiting this vulnerability in AI coding agents. In the first scenario, attackers submit benign plugins to trusted plugin marketplaces, pass security review processes, and subsequently replace the approved content with malicious code execution payloads1

1

. The second attack vector involves hijacking legitimate repository owners' accounts and pushing malicious versions to every agent with that plugin installed, bypassing SHA-pinning mechanisms entirely through techniques demonstrated in Air's earlier SkillJacking and RepoJacking proof-of-concept attacks1

1

.

What makes Plugin4Shell particularly dangerous is the auto-update feature enabled by default in Anthropic Claude Code and OpenAI Codex. When a pinned commit is swapped upstream, the agent's plugin automatically updates to the malicious version without requiring any user interaction, creating a true zero-click attack scenario1

1

. Because plugins run with the same access privileges as the developer using the agent, successful exploitation grants attackers access to source code, API keys, cloud credentials, CI/CD tools, and any systems the developer can access2

2

.

Pareekh Jain, principal analyst at Pareekh Consulting, emphasized that enterprises using AI coding agents with third-party plugins face significant exposure, particularly when those agents have access to critical development infrastructure and enterprise systems2

2

. The vulnerability could enable attackers to steal credentials, modify repositories, or establish persistent footholds within development environments.

Vendor Response and Current Protection Status

The response from affected vendors has been mixed, with only some addressing the RCE vulnerability through patches. Anthropic fixed the issue in Claude Code version 2.1.179, while OpenAI addressed it in Codex version 0.146.01

1

3

3

. However, Air Security researchers stress that "the fix has to ship in the agent, and updating is the only complete mitigation where one exists," meaning no marketplace-level solution can protect users from this vulnerability in AI coding agents1

1

.

Google has deprecated the Gemini CLI and informed Air Security it will not issue a patch, leaving every existing installation vulnerable. The company instead recommends users migrate to its newer Antigravity agentic development environment, which Air Security confirms is protected from Plugin4Shell attacks1

1

. The Gemini CLI faces a unique variant of the attack where its installer can be tricked by a repository whose main branch is named FETCH_HEAD, a technique not clearly blocked by GitHub's restrictions on hash-shaped names3

3

.

Microsoft has not fixed the flaw in Copilot, though GitHub stated that its platform-level restrictions prevent users from creating branch or tag names resembling commit hashes, theoretically preventing exploitation on GitHub-hosted plugin marketplaces1

1

. However, Air Security researchers contest this mitigation is insufficient because plugin marketplaces can be hosted on other platforms like Bitbucket, and Microsoft Copilot supports these alternative platforms, leaving it exposed to the vulnerability in AI coding agents1

1

. Air Security reported these concerns to Microsoft in June but received no response due to the company's high volume of disclosure submissions1

1

.

As of September 18, no CVE identifier had been assigned to Plugin4Shell, and none of the four vendors had published security advisories for the flaw3

3

. There is currently no evidence of the vulnerability being exploited in real-world attacks, though cybersecurity experts warn that the disclosure increases the likelihood of exploitation attempts targeting unpatched enterprise systems.