Summary
- A vulnerability dubbed Plugin4Shell allows attackers to bypass SHA-pinning in AI coding agent plugin marketplaces, enabling zero-click remote code execution.
- All major coding agents are affected: Claude Code, OpenAI Codex, Google Gemini CLI, and Microsoft Copilot. Anthropic and OpenAI have patched; Google and Microsoft have not.
- Gemini CLI will not receive a patch as Google has deprecated it — every existing install remains vulnerable. Google recommends migrating to its Antigravity environment.
- Microsoft has not patched Copilot despite disclosure in June; GitHub’s own mitigation is disputed by researchers as insufficient given Bitbucket and other marketplace hosts.
- The attack works by swapping a previously approved plugin’s commit to malicious code — agents auto-update and execute it without any user interaction.
What researchers found
Security researchers at Air, a startup focused on enterprise AI agent protection, have disclosed a vulnerability affecting all major AI coding agents. Dubbed Plugin4Shell, the flaw sits in how these agents implement SHA-pinning — a mechanism designed to lock plugins to a specific, audited commit hash rather than a mutable reference like a version tag or branch name. The idea is sound: if a plugin repository is compromised, the agent should continue running the pinned, verified code. In practice, the agents check out the correct commit but never verify they actually arrived at that hash. That gap is enough for an attacker to make the checkout resolve to malicious code while the pin still appears honoured.
Zero-click by design
The zero-click element stems from agents’ plugin auto-update behaviour. Both Claude Code and Codex update installed plugins automatically by default. When an attacker swaps the upstream commit referenced by a trusted marketplace listing, any agent with that plugin installed silently pulls and executes the replacement. No prompt. No user action. The researchers describe two viable attack paths: first, submitting a benign plugin that passes marketplace review and replacing it with malicious code after approval; second, hijacking a legitimate author’s repository and pushing malicious content to every agent that has that plugin installed. Air’s earlier SkillJacking and RepoJacking proof-of-concept work demonstrates that repository takeovers of this kind are achievable at scale.
Who has patched — and who has not
Air reported the issue to all four vendors in June. Anthropic addressed it in Claude Code version 2.1.179 and OpenAI in Codex version 0.146.0. Google has deprecated Gemini CLI entirely and told Air it will not issue a patch; all existing installations remain vulnerable. Google’s suggested path forward is migration to its newer Antigravity agentic development environment, which is not affected. Microsoft has not patched Copilot. A GitHub spokesperson told The Register that GitHub’s platform prevents users from creating branch or tag names that resemble commit SHAs, and that this mitigation means Plugin4Shell cannot be exploited on GitHub itself. The Air researchers counter that this protection does not extend to other platforms that host marketplaces — Bitbucket was cited specifically — and that Copilot’s support for those platforms keeps it exposed. Air told The Register that Microsoft had not responded to their disclosure despite months of contact, citing the volume of disclosures the company is currently managing. Microsoft did not respond to The Register’s request for comment.
Scale of exposure
Microsoft has stated that almost 90 percent of Fortune 500 companies use Copilot — a figure that gives some sense of the potential exposure. The researchers characterise Plugin4Shell as a first-of-its-kind AI supply-chain attack precisely because it targets the trusted marketplace layer rather than the model or agent itself. A single compromised or malicious plugin listing can propagate to millions of developer machines. Successful exploitation would give an attacker access to every asset and piece of data the agent can reach — source code, credentials, cloud configurations, internal APIs, and anything else within the agent’s operating scope.
The patch is the only complete fix
The Air researchers are direct on mitigation: updating the agent itself is the only complete remediation where a patch exists. Disabling auto-updates reduces exposure but does not address the underlying verification failure. For Gemini CLI, no patch is coming.
Why it matters
AI coding agents operate with broad, often privileged access to development infrastructure — repositories, secrets, cloud environments, and production pipelines. Plugin4Shell demonstrates that the supply-chain risk surface has extended directly into these agents via their plugin ecosystems. For CISOs, the immediate concern is that patching is not uniformly available: two of the four affected vendors have not shipped fixes, one has explicitly declined to do so, and the largest by enterprise footprint — Microsoft — has not responded to researchers who disclosed the issue months ago. Any organisation running Copilot, Gemini CLI, or unpatched versions of Claude Code or Codex should treat installed plugins as a potential vector and review agent permissions accordingly.
What to do now
- Update Claude Code to version 2.1.179 or later and OpenAI Codex to version 0.146.0 or later immediately.
- Audit all installed plugins across AI coding agents in your environment and remove any that are not actively required.
- Migrate away from Google Gemini CLI to the Antigravity environment, as Gemini CLI will not receive a patch.
- Review the permissions and data access scope granted to AI coding agents — limit to the minimum required for legitimate tasks.
- Disable or restrict automatic plugin updates where agent configuration permits, as a partial risk reduction measure until patches are available.
- Treat Microsoft Copilot plugin marketplaces sourced from platforms other than GitHub (such as Bitbucket) as unmitigated vectors until Microsoft confirms a fix.
