Plugin4Shell Exposes Major AI Coding Agents to Zero-Click Remote Code Execution Attacks

Critical Vulnerability in AI Coding Agents Exposes Enterprise Systems

A zero-click RCE flaw affecting all major AI coding agents has been disclosed by security researchers at Air Security, potentially exposing millions of enterprise development environments to remote code execution attacks1

1

. The vulnerability, dubbed Plugin4Shell, impacts Anthropic Claude Code, OpenAI Codex, GitHub Copilot, and Google Gemini CLI, allowing attackers to execute malicious code even when developers believe they're running approved, reviewed plugins2

2

.

Researchers Or Nevo, Dor Granat, and Niv Hoffman describe Plugin4Shell as a "first-of-its-kind AI supply-chain attack" that targets trusted plugin marketplaces rather than the models themselves1

1

. The flaw could reach approximately 90 percent of Fortune 500 companies that use GitHub Copilot, according to Microsoft's own figures1

1

.

How Plugin4Shell Bypasses SHA-Pinning Mechanisms

The vulnerability exploits a fundamental design flaw in how AI coding agents enforce SHA-pinning, a security mechanism intended to lock plugins to specific, immutable commit hashes1

1

. When developers install a plugin, they pin it to a reviewed commit hash—a unique cryptographic identifier that should ensure the agent runs only that specific, audited version of the code2

2

.

The problem lies in verification. Claude Code, Codex, and GitHub Copilot pass the commit hash directly to Git to check out pinned plugin code but never verify that Git actually checked out the commit corresponding to that SHA2

2

. Repository owners can exploit this gap by creating a branch whose name looks exactly like the legitimate commit hash, then pointing it at malicious code3

3

. When Git resolves the SHA, it quietly prefers the branch over the actual commit, installing the attacker's payload while reporting a clean install at the pinned version4

4

.

Google Gemini CLI breaks differently. After fetching the correct commit, it runs a checkout that a default branch named FETCH_HEAD can capture, meaning the legitimate code never reaches the disk4

4

.

Zero-Click Exploitation Through Auto-Update Features

What makes Plugin4Shell particularly dangerous is the auto-update feature built into these AI coding agents. Both Claude Code and Codex automatically update installed plugins by default, transforming this into a genuine zero-click attack requiring no action from victims1

1

3

3

.

Air Security outlined two primary attack scenarios. In the first, an attacker submits a genuinely useful plugin to a trusted marketplace, passes review, gathers users, then ships a routine update so the marketplace re-pins to a new commit hash4

4

. The attacker then creates a branch named after that new pin and fills it with malicious code—every agent's auto-update mechanism handles the rest4

4

.

The second attack vector involves hijacking a legitimate author's repository through previously demonstrated techniques like SkillJacking and RepoJacking, then pushing malicious versions onto every agent with that plugin installed1

1

.

Enterprise Systems Face Broad Exposure

Because plugins run with the same access privileges as the developer using the agent, swapped malicious code can access files, stored credentials, API keys, cloud credentials, source code repositories, and every system the developer can log into2

2

3

3

. This creates severe risks for enterprise systems, particularly in development environments with access to CI/CD tools and cloud infrastructure2

2

.

Pareekh Jain, principal analyst at Pareekh Consulting, notes that enterprises using AI coding agents with third-party plugins face the greatest exposure, especially when those agents have access to sensitive development assets2

2

.

Vendor Response and Patch Status

Air Security discovered the vulnerability in May and reported it to all four vendors in June3

3

4

4

. Anthropic patched the flaw in Claude Code version 2.1.179, with confirmation on June 174

4

. OpenAI addressed it in Codex version 0.146.0, describing the bug as Git being able to "interpret a requested commit SHA as a branch name"3

3

.

Google deprecated the Gemini CLI and told Air Security it will not patch the vulnerability, instead suggesting users migrate to its newer Antigravity agentic development environment, which is protected from this attack1

1

. However, Google has indicated that enterprise access to Gemini CLI will continue with updates, though whether a fix is included remains unclear3

3

.

Microsoft has not shipped a fix for GitHub Copilot1

1

. A GitHub spokesperson stated that the platform already applies restrictions preventing users from creating branch or tag names resembling commit SHAs, claiming this mitigation ensures the vulnerability cannot be exploited on GitHub1

1

.

Disputed Scope and Real-World Impact

Air Security contests GitHub's assessment, arguing the mitigation isn't sufficient because plugin marketplaces can be hosted on other platforms like Bitbucket, which allow hash-shaped branch names1

1

. Microsoft Copilot supports marketplaces from these platforms, leaving it vulnerable to Plugin4Shell attacks1

1

.

However, independent verification by The Hacker News found that every plugin in Anthropic's community catalog and in the default catalogs for Claude Code and Copilot points to GitHub repositories3

3

. Background auto-update runs by default only for agents' built-in marketplaces hosted on GitHub, staying off or optional for outside marketplaces3

3

. This suggests developers installing only from default, GitHub-based marketplaces may not face the branch-name attack variant4

4

.

As of September 18, no CVE identifier had been assigned, none of the four vendors had published security advisories, and there's no evidence of real-world exploitation3

3

. The fix requires updating the agent itself—no marketplace can resolve this for users3

3

. Enterprises should verify their AI coding agents are running patched versions and review their plugin sources and auto-update configurations to assess exposure.