A zero-click vulnerability that allows remote code execution affects all of the major AI coding agents, and researchers warn it could give an attacker full access to every asset and piece of data the agent can reach. The flaw, named Plugin4Shell, is being called a first-of-its-kind AI supply chain attack.
What Happened
What is Plugin4Shell?
Plugin4Shell is a zero-click remote code execution vulnerability in AI coding agents that bypasses SHA-pinning on plugin marketplaces. An attacker who controls a plugin repository can deliver malicious code that still appears pinned, giving full access to everything the agent can reach.
Which AI coding agents are affected?
Anthropic Claude Code, OpenAI Codex, Google Gemini CLI, Microsoft Copilot, and GitHub Copilot. Anthropic and OpenAI patched; Google deprecated Gemini CLI in favor of Antigravity; Microsoft's Copilot remains exposed according to the researchers.
How do I protect my coding agent?
Update Claude Code to 2.1.179 or newer and Codex to 0.146.0 or newer, migrate off Gemini CLI, restrict which plugin marketplaces your agent can pull from, and treat the agent's credentials like production secrets.
On September 17, 2026, security startup Air disclosed a zero-click vulnerability in the plugins that power AI coding agents. The attack, dubbed Plugin4Shell, affects Anthropic's Claude Code, OpenAI's Codex, Google's Gemini CLI, Microsoft's Copilot, and GitHub Copilot. Instead of targeting the model or the agent itself, Plugin4Shell attacks the trusted marketplaces that host plugins, which means a single compromise could reach millions of users and machines.
The research team, Air's Or Nevo, Dor Granat, and Niv Hoffman, framed the issue bluntly: the fix has to ship in the agent, and updating is the only complete mitigation where one exists. The team reported the flaw to all four vendors in June.
How Plugin4Shell Works
The vulnerability sits in how agents enforce a marketplace's SHA-pinning mechanism. SHA-pinning is a security feature that locks an agent plugin to a specific, immutable commit hash rather than a mutable reference like a version tag or branch name. The goal is to stop supply chain attacks: if a public skill repository is compromised, the agent keeps running the same audited code hash it pinned, instead of silently pulling in new malicious payloads.
The researchers describe Plugin4Shell as a plugin SHA-pinning bypass:
- The agent checks out the exact commit the marketplace pinned, but never verifies that it actually landed there.
- An attacker who controls the plugin's repository makes the checkout resolve to malicious code while the pin still looks honored.
- The result is zero-click remote code execution.
The agent's plugin auto-update feature makes the attack zero-click. When a pinned commit is swapped upstream, the agent's plugin gets replaced with a malicious version. Both Claude and Codex automatically update installed plugins by default.
The Two Attack Scenarios
The researchers outline two ways an attacker could abuse the flaw:
- In the first, the attacker submits a benign plugin to a trusted marketplace. The plugin passes review, and the attacker later replaces the benign content with malicious code.
- In the second, the attacker hijacks a legitimate author's repository and pushes a malicious version onto every agent that has it installed, bypassing the SHA-pinning safety mechanism entirely.
The team demonstrated the takeover approach in earlier proof-of-concept attacks it calls SkillJacking and RepoJacking. Together, the chain is proven end to end, and Plugin4Shell defeats the mechanism built to contain it.
Who Is Affected and What Was Patched
The impact differs by vendor. Anthropic patched the flaw in Claude Code version 2.1.179, and OpenAI patched Codex in version 0.146.0. Google took a different route: it deprecated the Gemini CLI and told Air it will not patch, leaving every existing install vulnerable. Google instead suggests users migrate to its newer Antigravity agentic development environment, which is protected from the attack.
Microsoft did not fix the flaw in Copilot. A GitHub spokesperson told The Register that Plugin4Shell attacks do not affect GitHub, because GitHub does not allow users to create branch or tag names that resemble commit SHAs, a mitigation that prevents the reported vulnerability from being exploited on GitHub.
The Air researchers said that GitHub's mitigation is not sufficient to defeat Plugin4Shell attacks, because marketplaces can also be hosted on other platforms such as Bitbucket. Microsoft Copilot remains vulnerable because it supports marketplaces from such platforms as well. Air also reported the issue to Microsoft in June but said it did not get a response.
Why This Matters
The significance of Plugin4Shell is that it turns the AI supply chain into an attack surface. Coding agents already hold extraordinary privileges: they can read source code, write files, run commands, and in many setups reach cloud credentials and production deployments. A zero-click compromise of the plugin layer hands an attacker all of that with no interaction from the developer.
The scale compounds the risk. AI coding tools have gone from novelty to default in a few short years. When a tool reaches that level of adoption and carries the privileges these agents do, a single supply chain flaw becomes a systemic risk rather than a niche bug. The dependency is not optional tooling anymore: for many teams, the coding agent is now the primary author of production code, which means a compromise of the agent is effectively a compromise of the codebase it writes.
There is also a timing problem that makes this harder to contain than a traditional bug. Because the attack rides on auto-update, the malicious code arrives silently and the pin looks intact, so developers have no obvious signal that their plugin changed. By the time the flaw is noticed, the agent may already have been instructed to clone credentials, leak secrets, or plant a backdoor, and the auditing trail points back to a pinned commit that never actually contained the malicious code. This is the same supply chain pattern that has repeatedly hit package managers, now applied to the layer where software is written. If you are building these systems, the practical lesson from recent AI failures is the same one that applies to any tool with production credentials: verify the supply chain, scope the permissions, and plan for the attack you did not see coming, as we covered in our guide to building reliable AI workflows.
What to Do Now
Developers and teams using AI coding agents should act immediately. The good news is that the highest-risk paths have concrete fixes that ship today, not weeks from now:
- Update Claude Code to at least version 2.1.179 and Codex to at least 0.146.0.
- If you use Gemini CLI, migrate to Google's Antigravity environment rather than waiting for a patch that is not coming.
- Review which plugin marketplaces your agent can pull from, and disable any that are not strictly trusted.
- Audit installed plugins for signs of recent upstream changes, especially any that auto-update.
- Treat your coding agent's credentials like production credentials: scope them tightly and rotate them if you suspect exposure.
Beyond the immediate patches, treat this as the moment to review how much authority your coding agents actually hold. A coding agent does not need standing access to every repository or every cloud account; it needs the least privilege that lets it do its job. Enforcing that boundary now means that even a future supply chain flaw, and there will be more, is contained to the smallest possible surface instead of handing over the keys to the kingdom.
Sources & Verifications
- The Register (Jessica Lyons, September 17, 2026): Plugin4Shell affects all major AI coding agents; zero-click RCE; vendor patch status; Air researchers. https://www.theregister.com/security/2026/09/17/ai-coding-agents-0-click-rce-flaw-could-hand-attackers-keys-to-the-kingdom/5297335
- Air security blog (Or Nevo, Dor Granat, Niv Hoffman): Plugin4Shell research; SHA-pinning bypass details; SkillJacking and RepoJacking proofs of concept. https://www.air.security/blog-posts/plugin4shell
- Microsoft AI news (September 2026): roughly 90 percent of Fortune 500 companies use Copilot. https://news.microsoft.com/ai-in-action/
- Google Developers Blog: announcement transitioning Gemini CLI to Antigravity CLI. https://developers.googleblog.com/an-important-update-transitioning-gemini-cli-to-antigravity-cli/
Post a Comment