A zero-click remote code execution (RCE) vulnerability, dubbed “Plugin4Shell,” has been identified in several prominent AI coding agents, potentially allowing attackers full access to data and assets reachable by the compromised agent. The flaw affects Anthropic’s Claude Code, OpenAI’s Codex, Google's Gemini CLI, Microsoft’s Copilot, and Microsoft-owned GitHub Copilot.
Security researchers at Air, a startup specializing in enterprise AI agent protection, describe Plugin4Shell as a “first-of-its-kind AI supply-chain attack.” Rather than targeting the AI model or agent directly, the exploit leverages trusted marketplaces that host plugins for these coding agents. This approach could potentially impact millions of users and machines.
The vulnerability stems from how agents enforce SHA-pinning mechanisms for plugins. SHA-pinning is designed to prevent supply chain attacks by locking agent plugins to a specific, immutable commit hash, rather than a mutable reference like a version tag or branch name. This ensures that if a public skill repository is compromised, the AI agent continues to run the original, audited code hash.
However, the Air researchers, Or Nevo, Dor Granat, and Niv Hoffman, found that while the agent checks out the exact commit specified by the marketplace, it fails to verify that the intended code actually landed there. An attacker who controls a plugin’s repository can manipulate the checkout process to resolve to malicious code, even though the SHA pin appears to be honored. This results in zero-click RCE, particularly because agents like Claude and Codex automatically update installed plugins by default.
The researchers outlined two primary attack scenarios. In the first, an attacker submits a benign plugin to a trusted marketplace, which passes review. Subsequently, the attacker replaces the benign content with malicious code. The second scenario involves hijacking a legitimate author's repository and then pushing a malicious version, effectively bypassing the SHA pinning safety mechanism. This builds upon their previous "SkillJacking" and "RepoJacking" proof-of-concept attacks.
Air reported the vulnerability to all four affected vendors in June. Anthropic and OpenAI have since patched the flaw in Claude Code version 2.1.179 and Codex version 0.146.0, respectively.
Google has deprecated its Gemini CLI and stated it will not issue a patch, leaving existing installations vulnerable. The company advises users to migrate to its newer Antigravity agentic development environment, which is protected from this attack.
Microsoft has not released a fix for Copilot. A GitHub spokesperson stated that Plugin4Shell attacks do not affect GitHub, citing a mitigation that prevents users from creating branch or tag names resembling commit SHAs. However, the Air researchers contend this mitigation is insufficient, as marketplaces can be hosted on other platforms like Bitbucket. They also noted that Microsoft Copilot remains vulnerable because it supports marketplaces from such platforms. Air reported the issue to Microsoft in June but did not receive a response.
According to Microsoft, nearly 90 percent of Fortune 500 companies utilize Copilot. The Air researchers emphasize that a complete mitigation requires an update to the agent itself.
