Plugin4Shell exposes zero click RCE in Claude Code, Codex, Copilot and Gemini CLI

The modern AI coding agent rarely arrives as a bare command line tool. Anthropic's Claude Code, OpenAI's Codex, GitHub Copilot and Google's Gemini CLI all extend themselves through plugins distributed by online marketplaces, and those marketplaces depend on a single promise: that a plugin locked to one reviewed version by its commit hash will keep running that reviewed version. Developers installed those plugins by the millions on the assumption that the pin, a 40 character SHA, was the security boundary.

That assumption collapsed in September 2026. Air Security's research lab published a vulnerability it calls Plugin4Shell on September 17, 2026, describing it as the first supply chain vulnerability of the AI agent ecosystem. The bug is a plugin SHA pinning bypass. Affected agents check out the commit hash a marketplace pinned but never verify that the working tree actually landed on it, so an attacker who controls the plugin repository can make the checkout resolve to malicious code while the pin still looks honored. The result is zero click remote code execution on machines the user never touched.

Air Security said the flaw affects four of the most popular coding agents: Anthropic Claude Code, OpenAI Codex, GitHub Copilot and Google Gemini CLI. Millions of agents are affected, according to the firm's disclosure. Two vendors moved quickly to patch. Anthropic's fix shipped as Claude Code 2.1.179, and OpenAI's shipped as Codex 0.146.0. Microsoft has not shipped a Copilot fix, and Google is retiring Gemini CLI without patching it, directing users to a newer product called Antigravity.

The timing is awkward for enterprises. Almost 90 percent of Fortune 500 companies use Copilot, according to Microsoft, and that is the agent still waiting for a fix, while the product Google abandoned stays in production wherever teams have not yet migrated.

Key Facts

Air Security reported on September 17 that Claude Code, Codex and GitHub Copilot are all attacked the same way: by creating a branch named with the exact 40 hex pinned SHA and making it the repository's default branch. Git prefers a ref over an object id of the same name, so the checkout lands on the attacker's branch while the agent reports back the pinned version. Gemini CLI takes a different route. Its installer clones, fetches the pinned commit and then runs a checkout of FETCH_HEAD, so a default branch named FETCH_HEAD wins instead and the correctly fetched commit is discarded.

Help Net Security reported on September 18 that the flaw reaches people who did everything right. The publication quoted Air's assessment that anyone running a major coding agent which installs plugins from a marketplace is exposed, and that the victim only has to have a plugin installed, from a marketplace they trust, that was reviewed and pinned exactly as the security model intends. Because the checkout re-runs on background auto-update, and auto-update is the default in Claude Code and Codex, the swap reaches already-installed, already-trusted plugins with no user action at all.

The Hacker News reported on September 18 that no CVE identifier had been assigned and that none of the four vendors had published a security advisory, even as OpenAI's own patch notes confirmed the bug. OpenAI described how Git can interpret a requested commit SHA as a branch name, so that a plugin source could materialize a different commit than the one it pinned. The review also found a real mitigation: GitHub forbids branch or tag names that resemble commit hashes, so GitHub hosted plugins are not exposed to the branch trick. Air countered that the technique works on Bitbucket and on self-hosted git servers, which the agents support.

The Register reported on September 17 that the exploit could give attackers full access to every asset and piece of data the agent can reach. Air researchers Or Nevo, Dor Granat and Niv Hoffman wrote that the agent checks out the exact commit the marketplace pinned but never verifies it landed there, so an attacker who controls the plugin's repo makes the checkout resolve to malicious code while the pin still looks honored. The Register also reported the disputed vendor response, in which a GitHub spokesperson said GitHub does not allow branch or tag names resembling commit SHAs, and Air's counter that Copilot supports marketplaces hosted on Bitbucket.

The numbers behind the disclosure come from Air's earlier work. The firm previously showed that a plugin it built spread to more than 26,000 agents before being pulled, and its SkillJacking research documented 925 in-use skills being hijacked and reaching 134,000 agents. Those campaigns amount to a rehearsal for the two entry paths Plugin4Shell enables: publish a benign plugin and later turn it malicious, or hijack a legitimate author's repository outright.

Analysis

The bigger picture here is that the AI agent ecosystem has reproduced, in roughly two years, the same trust failure that took the wider software supply chain a decade to confront. Pinning a commit hash is a proxy for review, not review itself. Air's suggested fix makes the gap plain: after checkout, compare the revision reported by git to the pinned SHA and abort on mismatch. That is a few characters of code standing between a developer's laptop and an attacker, and two of the four vendors have still not shipped it.

What this really means is that the risk is concentrated rather than evenly distributed. Anthropic confirmed the Claude Code 2.1.179 patch on June 17, 2026, and OpenAI's Codex 0.146.0 was verified fixed on August 12, 2026, both months before the public disclosure. Google confirmed on August 4, 2026 that it would deprecate Gemini CLI rather than patch it. Microsoft, by contrast, has no Copilot fix, and Copilot is the agent that almost 90 percent of Fortune 500 companies use. The vendor with the largest enterprise footprint carries the longest exposure.

The disclosure timeline deserves scrutiny too. Air found the bug in May 2026 with working proof-of-concept exploits against all four agents, and disclosed it to each vendor in June 2026 under coordinated disclosure. That is a conventional window, and two vendors met it. The other two effectively declined to, one by silence and one by product retirement. Coordinated disclosure assumes a vendor that intends to fix the problem. It has no answer for a vendor that decides the product should not exist.

InfoWorld reported on September 18 that analyst Pareekh Jain, principal analyst at Pareekh Consulting, warned that enterprises using AI coding agents with third-party plugins are likely the most exposed, particularly when those agents can reach source code, credentials, cloud systems or CI/CD tooling. His reasoning is structural: plugins largely run with the same access the developer or employee has, so malicious plugins could help attackers read source code, steal API keys or cloud credentials, change repositories, or reach CI/CD and corporate systems. He advised security teams to examine EDR, git, CI/CD, cloud IAM and authentication logs, and noted that the underlying flaw remains a vendor responsibility.

Why It Matters

What makes Plugin4Shell unusual is that it inverts the usual advice about plugin hygiene. Security teams tell developers to install only reviewed, pinned plugins from trusted marketplaces. Here, that is exactly the configuration that is exposed. The victim does not have to be careless. The victim has to have a plugin installed. Air's framing, reported by Help Net Security on September 18, is that exposure is not limited to users who install plugins carelessly, but applies to anyone with a plugin from a marketplace they trust that was reviewed and pinned exactly as the security model intends.

The blast radius follows the agent's permissions, not the plugin's. A coding agent typically holds repository access, saved credentials, cloud logins and a seat in CI/CD pipelines. As The Register reported on September 17, the flaw could give attackers full access to every asset and piece of data the agent can reach, which is why Air described it as handing over the same reach into a company's systems and data as the employee running the agent. A single swapped plugin is not a single compromised machine. It is a foothold carrying a developer's entire permission set.

There is also a governance problem. As of September 18 no CVE had been assigned and no vendor advisory had been published, which means the usual scanner and patch-orchestration pipeline has nothing to match on. Security teams cannot rely on a signature that does not exist. They have to reason from product versions, deployment inventories, and the question of which agents in their estate can still install a plugin from a marketplace at all.

Next Up

The immediate work is version hygiene. Organizations running Claude Code should be on 2.1.179 or later, and organizations running Codex should be on 0.146.0 or later. Copilot users have no patch to apply and should treat plugin installation from third-party marketplaces as an open risk, while Gemini CLI users are being told to migrate to Antigravity because Google will not patch the retired product. The verification step Air recommends, comparing the checked out revision to the pinned SHA and aborting on mismatch, is a control defenders can ask plugin platforms to implement even where the agent vendor has not.

The larger question the disclosure leaves open is who owns supply chain verification in an agent ecosystem where the marketplace, the code host and the agent vendor are three different parties. GitHub's branch naming restriction already blocks the technique on its own hosting, which shows the mitigation can live at the host layer rather than inside the agent. Whether that becomes a cross-industry expectation, or stays a competitive detail, is the thing to watch next.