Do Son 
Image: AIR Security
TL;DR
AIR Security disclosed Plugin4Shell, a zero-click remote code execution flaw in four AI coding agents. The bug defeats SHA pinning, the check meant to lock a plugin to reviewed code. Claude Code and Codex are patched. Copilot and Gemini CLI are not.
Track every CVE that hits your stack the moment it's exploited.
Get free email alertsWhy This AI Coding Agent Flaw Matters
Millions of installed agents run plugins from trusted marketplaces. Plugin4Shell turns that trust against the user. AIR Security calls it “the first supply chain vulnerability of the AI agent ecosystem.”
The reach is severe. A successful attack yields full control of the agent and its host. That means access to source code, API keys, CI/CD credentials, and cloud environments. Notably, doing everything right offers no shield. As the researchers put it, the victim “only has to have a plugin installed, from a marketplace they trust, that was reviewed and pinned exactly as the security model intends.”
How the Attack Works
SHA pinning locks a plugin to one reviewed commit. The idea is simple: review the code once, pin that commit, and trust it forever after. Plugin4Shell breaks that promise. The agent checks out the pinned commit but never confirms the commit actually landed in the working tree.
The Branch-Name Trick
For Claude Code, Codex, and GitHub Copilot, the attacker controls the plugin repo. Then they create a branch named after the exact 40-character pinned hash and set it as the default. When git checks out that hash, it prefers the matching branch reference over the commit object. As a result, attacker code runs while the pin still looks honored.
The Gemini CLI Variant
Gemini CLI fetches the right commit, then checks out FETCH_HEAD. However, if the repo’s default branch is itself named FETCH_HEAD, the checkout resolves to that branch instead. The fetched commit is quietly discarded.
What Makes It Zero-Click
Plugin auto-update is the trigger. Claude Code and Codex update installed plugins in the background by default. So when the pinned commit is swapped upstream, an already-trusted plugin flips to a malicious version. No install step, no prompt, nothing to notice. The attacker only needs a benign plugin already present on the machine.
Affected Versions and Exploitation Status
Four agents are confirmed affected: Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI. No CVE identifiers have been assigned to Plugin4Shell at the time of writing. The advisory tracks it by name only.
AIR reported the flaw to all four vendors in June 2026, with working proof-of-concept exploits against each. However, no exploitation in the wild has been confirmed. AIR also notes that enterprises using Air Marketplace and Air Filter were not affected.
Patch and Mitigation Steps
The fix must ship inside the agent, since the pin resolves on the client. Therefore no marketplace can close this gap alone. Update your agent where a patch exists.
- Claude Code – Anthropic patched it in version 2.1.179.
- Codex – OpenAI patched it in version 0.146.0.
- GitHub Copilot – Microsoft has not shipped a fix, so users have no patch.
- Gemini CLI – Google deprecated the tool and will not patch it. Those users should migrate to Antigravity, which this attack does not reach.
The core defense is one assertion inside the agent: after checkout, resolve the actual HEAD and abort unless it matches the pinned SHA. Until every vendor ships that check, updating remains the only complete mitigation for this AI coding agent threat.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
