'Plugin4Shell' Hits All Four Major AI Coding Agents — Claude Code, Codex, Copilot and Gemini CLI

Security lab AIR disclosed a zero-click remote code execution vulnerability against AI coding agents, dubbed Plugin4Shell, on September 17. The researchers called it "the first supply chain vulnerability of the AI agent ecosystem." The core point is stark: anyone who installs plugins from a marketplace is exposed, and not only careless users. The victim only has to have a plugin installed — from a marketplace they trust, reviewed and pinned exactly as the security model intends.

Why SHA pinning broke

Plugin "SHA pinning" locks an installed plugin to a specific version of code that passed review. Once a plugin clears review, pinning is supposed to mean its code cannot change without the developer's knowledge. Plugin4Shell defeats that guarantee.

According to AIR, every one of the four agents checks out the pinned commit but never verifies that the checkout actually landed there — letting an attacker swap in malicious code while the pin still looks intact. The researchers describe this as a "plugin SHA-pinning bypass." Claude Code, Codex and GitHub Copilot share one variant, tied to how git handles branch names; Gemini CLI is exposed through a separate mechanism in how it fetches and checks out pinned commits, though the outcome is the same.

Why it's "zero-click"

The flaw is dangerous because it reaches people who did everything right. AIR says it "is not only an install-time bug, and that is what makes it zero-click." Because background auto-update — the default in Claude Code and Codex — re-runs the same git checkout, the swap reaches already-installed plugins with no user action the moment the marketplace bumps the pinned SHA.

There is a condition, though. AIR notes the attack "only works where a branch can be named like a hash." That is git's default behavior, but some hosts forbid it: GitHub rejects a 40-hex branch name outright, while others — Bitbucket among them, and any self-hosted git server — allow it.

How an attacker gets in

AIR laid out two paths. In the first, an attacker publishes a plugin that works exactly as advertised, passes review and gains adopters, then turns it malicious later. The researchers say earlier work proved this out: a plugin they built spread to more than 26,000 agents before being pulled.

In the second, an attacker takes over the repository behind a plugin others wrote and users already trust, then uses the same bypass to push malicious code to everyone who has it installed. AIR demonstrated this kind of takeover in separate research it calls SkillJacking, where it found 925 skills already in active use had been hijacked from their original maintainers, reaching 134,000 agents. "Together, the chain is proven end to end — takeovers happen at scale, and Plugin4Shell defeats the mechanism built to contain them," the researchers said.

Vendors responded unevenly

Because the check runs inside the agent rather than at the marketplace, AIR says no marketplace can guarantee the protection on its own. Each vendor has to fix it in the agent itself, and where a fix exists, updating is the only complete remedy.

Google went the other way, deprecating Gemini CLI rather than patching it — which means every existing install stays exposed indefinitely. Google's advice to those users is to move to Antigravity, a newer agent built without the plugin pinning system this attack relies on.

What it means

Plugin4Shell exposes a blunt truth: AI coding agents inherit the same access as the developer running them — local source, cloud credentials, SSH keys, internal repositories, secrets. The plugin and skill marketplaces built for convenience have become a new supply-chain attack surface. With the "pinned means safe" assumption broken, agent vendors need to verify checkout results by default, and users have to manage the trust chain of their extensions as carefully as they manage code.