1d:I[70616,["/_next/static/chunks/0kcf5dt6yxdox.js","/_next/static/chunks/1su5n1uv1ti4s.js","/_next/static/chunks/0gvke1wv6udfg.js","/_next/static/chunks/1dfrle3jgmlzh.js","/_next/static/chunks/162lgvduyr-fa.js","/_next/static/chunks/2gcnnopam8e9w.js","/_next/static/chunks/2g60iab5a1pkg.js"],"Breadcrumb"] 1e:I[90762,["/_next/static/chunks/0kcf5dt6yxdox.js","/_next/static/chunks/1su5n1uv1ti4s.js","/_next/static/chunks/0gvke1wv6udfg.js","/_next/static/chunks/1dfrle3jgmlzh.js","/_next/static/chunks/162lgvduyr-fa.js","/_next/static/chunks/2gcnnopam8e9w.js","/_next/static/chunks/2g60iab5a1pkg.js"],"ArticleGrid"] 1f:T1fae,

Security firm Air disclosed a vulnerability on Thursday that gives an attacker remote code execution on the machines of developers using AI coding assistants, with no user interaction required. Named Plugin4Shell in the company's research report, it affects Anthropic's Claude Code, OpenAI's Codex, GitHub Copilot and Google's Gemini CLI.

Two of those four vendors have shipped a patch. Anthropic fixed it in Claude Code 2.1.179 and OpenAI in Codex 0.146.0, while Microsoft has released nothing for Copilot and Google says it will not patch the deprecated Gemini CLI at all.

Nothing in the attack touches a model or an agent's reasoning. It sits one layer down, in the marketplace plumbing that delivers add-ons onto a working laptop — and a plugin runs with whatever access the engineer operating the agent has.

Key takeaways

Air researchers Or Nevo, Dor Granat and Niv Hoffman found the same missing verification step in Claude Code, Codex, GitHub Copilot and Gemini CLI.
Anthropic shipped a fix in Claude Code 2.1.179 and OpenAI in Codex 0.146.0; Microsoft has released nothing for Copilot and Google will not patch the deprecated Gemini CLI.
Background plugin auto-update, on by default in Claude Code and Codex, is what removes the click from the attack.

Why SHA pinning was supposed to end this

Pinning exists because the alternative already failed publicly. Air's own prior work supplied much of the evidence: a deliberately malicious skill it published into a trusted marketplace reached more than 26,000 agents, and a follow-up study hijacked 925 skills that were already in active use, touching 134,000 agents. The industry response was to stop trusting names. A branch or a version tag can move; a 40-character commit hash cannot.

That reasoning is sound, and it is exactly the reasoning that failed here. Pinning only delivers its guarantee if somebody checks the outcome, and the client-side code doing the install turned out to check the request instead. Enterprises that went furthest — vetting plugin source, pinning a reviewed commit, treating the hash as an audit artifact — inherited the flaw most completely, because their entire control depended on the step that was skipped.

Where the check goes missing

Git is unusually permissive about what a branch may be called. Its own reference-format validator will accept a name made of 40 hexadecimal characters, and when a string is simultaneously a valid reference and a plausible object ID, git picks the reference and downgrades the conflict to a warning nobody reads. An attacker holding the plugin repository can therefore create a branch whose name is character-for-character the pinned hash, promote it to the repository default, and watch the install land on content of their choosing while the agent reports success at the expected commit. Claude Code, Codex and GitHub Copilot all fall to that variant.

Gemini CLI breaks along a different seam. It fetches the pinned object correctly and writes it to the repository's FETCH_HEAD file, then performs a checkout of FETCH_HEAD by name — a name a hostile repository is free to claim as its default branch, at which point the correctly fetched commit is simply discarded.

What closes both variants is a single assertion: after the checkout completes, resolve HEAD, compare it to the hash that was requested, and abort if they differ. The distinction that matters is checking the resolved result rather than the reference that was asked for, which is precisely what the Gemini variant slips past.

The auto-update multiplier

An install-time bug would be serious. This one is worse because agents re-run that same checkout on their own schedule. Claude Code and Codex refresh installed plugins in the background as default behavior, so a hash bump upstream propagates without an install step, a prompt or any visible event. The attacker never has to convince anyone to add anything; the plugin they need is already sitting on the target machine, already trusted.

Two entry paths follow from that, and neither requires compromising a marketplace. An attacker can publish something genuinely useful, clear review, and change its contents later. Or they can take over the repository behind a plugin written by somebody else — the precise scenario pinning was adopted to contain. Both halves have now been demonstrated separately, which is what makes the chain credible rather than theoretical.

Two vendors patched, two did not

Air notified all four vendors in June under coordinated disclosure, and the responses diverged sharply. Anthropic and OpenAI shipped fixes. Google declined, telling the researchers Gemini CLI is deprecated and steering users to its Antigravity environment, which has no marketplace plugin pinning to subvert. Microsoft, according to the researchers, never responded at all.

GitHub disputes its exposure. A spokesperson told The Register the platform blocks branch and tag names resembling commit hashes, so the technique cannot run there. Air's answer is that agents do not only consume GitHub-hosted marketplaces — Anthropic's documentation lists Bitbucket and self-hosted git among supported backends, and those accept hash-shaped branch names normally. With Microsoft citing roughly 90 percent Fortune 500 adoption of Copilot, the unpatched surface is not small.

What this means for plugin governance

The uncomfortable structural point is that no marketplace can fix this for its users. The pin is evaluated on the client, so the guarantee a marketplace advertises is enforced somewhere it has no code running. That inverts the assumption behind a lot of current enterprise procurement, where an approved marketplace is treated as the control boundary. Efforts like the vendor-neutral Agent Plugins standard may help by making verification behavior specifiable rather than per-vendor. For now the practical advice is narrow: update Claude Code and Codex, and for Copilot and Gemini CLI, inventory what is installed and where it is hosted. Anyone who followed the ChainDrop worm that poisoned 444 npm packages carrying valid signatures will recognize the pattern — the integrity mechanism was present, and presence was mistaken for enforcement.

FAQ

Is my AI coding agent affected by Plugin4Shell?

You are exposed if you run Claude Code, OpenAI Codex, GitHub Copilot or Gemini CLI with plugins installed from a marketplace. Claude Code 2.1.179 and Codex 0.146.0 contain fixes, so updating closes it for those two. Copilot and Gemini CLI currently have no patch available.

Does using GitHub-hosted plugins protect me?

Partly. GitHub rejects branch and tag names shaped like commit hashes, which blocks the primary variant on that platform. Air's researchers note that agents also support marketplaces on Bitbucket and self-hosted git servers where the trick still works, and that GitHub's rule does nothing about the separate Gemini CLI variant.

Can a marketplace fix this on its own?

No. The pinned commit is resolved on the client machine when the agent runs its checkout, so only an agent-side verification step can guarantee the pin was honored. A marketplace can restrict which git hosts it permits, but that narrows supported configurations without closing the underlying flaw.

a:["$","div",null,{"className":"mx-auto max-w-7xl px-4 py-8 sm:px-6","children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"BreadcrumbList\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https://ainewsway.com\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"#plugin4shell\",\"item\":\"https://ainewsway.com/tag/plugin4shell\"}]}"}}],["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"ItemList\",\"@id\":\"https://ainewsway.com/tag/plugin4shell#itemlist\",\"name\":\"#plugin4shell Articles\",\"numberOfItems\":1,\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"url\":\"https://ainewsway.com/articles/plugin4shell-a-zero-click-rce-hits-claude-code-codex-copilot-and-gemini-cli-mu6i4s8t\",\"name\":\"Plugin4Shell: A Zero-Click RCE Hits Claude Code, Codex, Copilot and Gemini CLI\"}]}"}}],["$","$L1d",null,{"items":[{"label":"# plugin4shell"}]}],["$","h1",null,{"className":"mb-8 text-3xl font-bold text-zinc-900 dark:text-zinc-100","children":["#","plugin4shell"]}],[["$","$L1e",null,{"articles":[{"id":"68fb072b-1e6a-4464-9a44-a0db6f435feb","slug":"plugin4shell-a-zero-click-rce-hits-claude-code-codex-copilot-and-gemini-cli-mu6i4s8t","title":"Plugin4Shell: A Zero-Click RCE Hits Claude Code, Codex, Copilot and Gemini CLI","subtitle":"Security firm Air says every major coding agent trusts a pinned plugin version it never verifies","content":"$1f","excerpt":"A zero-click RCE called Plugin4Shell bypasses the commit pinning AI coding agents use to keep plugins trustworthy. Two of four vendors have shipped a patch.","coverImage":"https://cdn.ainewsway.com/uploads/2026/09/eaad9c87-9c3f-4204-90f7-156f4aa2b21c.webp","coverImageCaption":"Source code on a developer's screen — Plugin4Shell turns a routine git checkout inside AI coding agents into remote code execution.","authorId":"6773f67d-d7fa-4b19-8f38-384f10ac761b","status":"PUBLISHED","publishedAt":"2026-09-18T05:12:40.306Z","viewCount":0,"likeCount":0,"readingTime":6,"isFeatured":false,"isBreakingNews":false,"metaTitle":"Plugin4Shell: Zero-Click RCE in 4 AI Coding Agents","metaDescription":"Air Security's Plugin4Shell defeats plugin SHA pinning in Claude Code, Codex, Copilot and Gemini CLI. Anthropic and OpenAI patched it; Microsoft has not.","metaKeywords":["Plugin4Shell","AI coding agents","Claude Code","OpenAI Codex","GitHub Copilot","Gemini CLI","supply chain attack","SHA pinning"],"ogImage":null,"aiSummary":"Air Security disclosed Plugin4Shell, a zero-click remote code execution flaw affecting Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI. All four agents check out a marketplace-pinned commit without verifying it landed in the working tree, letting an attacker who controls a plugin repository serve malicious code while the pin still appears honored. Anthropic patched Claude Code 2.1.179 and OpenAI patched Codex 0.146.0. Microsoft has shipped no fix, and Google will not patch the deprecated Gemini CLI.","aiTags":[],"sentiment":null,"articleType":"ANALYSIS","videoEmbed":null,"videoType":null,"seoScore":85,"isAutoGenerated":true,"isBackfill":false,"pipelineStage":null,"copyrightScore":null,"similarityScore":null,"matchedSourceId":null,"createdAt":"2026-09-18T05:12:13.567Z","updatedAt":"2026-09-18T06:14:19.616Z","contentUpdatedAt":"2026-09-18T06:14:19.615Z","deletedAt":null,"author":{"id":"6773f67d-d7fa-4b19-8f38-384f10ac761b","name":"Seung Jung","username":"Seung Jung","avatar":null},"categories":[{"id":"32f2303b-b593-473f-bf9c-6a99acbe6ce1","name":"Developer Tools","slug":"developer-tools"}],"tags":[{"id":"98246980-4d05-4ceb-ae83-091033f73aa8","name":"AI Coding Agents","slug":"ai-coding-agents"},{"id":"93ba9ae0-5bda-44bb-9be7-321b037a44a9","name":"Claude Code","slug":"claude-code"},{"id":"c3ea531c-0bd4-483a-8d99-b10d931913b2","name":"Supply Chain Security","slug":"supply-chain-security"},{"id":"10e9deed-b112-4a23-82c2-5e15f6fb109a","name":"GitHub Copilot","slug":"github-copilot"},{"id":"32f27ef1-a197-4763-b33d-3f0850bfbd42","name":"Plugin4Shell","slug":"plugin4shell"}],"translations":[{"id":"5ab5267e-ffc9-4f1a-876d-9a66b1a68e01","language":"es","title":"Plugin4Shell: un RCE sin un solo clic golpea a Claude Code, Codex, Copilot y Gemini CLI","subtitle":"La firma de seguridad Air afirma que todos los grandes agentes de programación confían en una versión anclada del plugin que nunca verifican","excerpt":"Un RCE sin interacción llamado Plugin4Shell sortea el anclaje a commits que los agentes de programación con IA usan para confiar en sus plugins. Solo dos de los cuatro proveedores han parcheado.","metaTitle":"Plugin4Shell: RCE sin clic en 4 agentes de IA","metaDescription":"Plugin4Shell, de Air Security, vence el anclaje SHA de plugins en Claude Code, Codex, Copilot y Gemini CLI. Anthropic y OpenAI lo parchearon; Microsoft no."},{"id":"5358626d-70d1-4f54-9cee-679423ff3848","language":"ja","title":"Plugin4Shell、ゼロクリックのRCEがClaude Code・Codex・Copilot・Gemini CLIを直撃","subtitle":"主要なコーディングエージェントはいずれも、検証しないまま固定されたプラグインのバージョンを信じているとセキュリティ企業Airが指摘","excerpt":"Plugin4Shellと名付けられたゼロクリックのRCEが、AIコーディングエージェントのコミットピン留めを回避します。4社のうち修正を出したのは2社にとどまります。","metaTitle":"Plugin4Shell、AIコーディング4製品にゼロクリックRCE","metaDescription":"Air SecurityのPlugin4Shellは、Claude Code・Codex・Copilot・Gemini CLIのプラグインSHAピン留めを無効化します。AnthropicとOpenAIは修正済み、Microsoftは未対応です。"},{"id":"a599246d-f070-4e6b-8b0f-2b0ce60fa39a","language":"ko","title":"Plugin4Shell, 제로클릭 원격 코드 실행이 Claude Code·Codex·Copilot·Gemini CLI를 관통했다","subtitle":"보안 기업 Air는 주요 코딩 에이전트 전부가 검증하지 않는 플러그인 고정 버전을 그대로 믿는다고 밝혔다","excerpt":"Plugin4Shell로 명명된 제로클릭 원격 코드 실행 취약점이 AI 코딩 에이전트의 커밋 고정을 우회한다. 네 개 벤더 중 두 곳만 패치를 내놨다.","metaTitle":"Plugin4Shell, AI 코딩 에이전트 4종 제로클릭 RCE","metaDescription":"Air Security의 Plugin4Shell이 Claude Code·Codex·Copilot·Gemini CLI의 플러그인 SHA 고정을 무력화한다. Anthropic과 OpenAI는 패치했고 Microsoft는 내놓지 않았다."},{"id":"0c0c3afb-9f3a-4386-9af8-04dd59c4c855","language":"zh","title":"Plugin4Shell：零點擊 RCE 打穿 Claude Code、Codex、Copilot 與 Gemini CLI","subtitle":"資安公司 Air 指出，各大程式代理都信任一個自己從未驗證過的釘選外掛版本","excerpt":"名為 Plugin4Shell 的零點擊 RCE 繞過了 AI 程式代理用來確保外掛可信的提交釘選機制，四家業者中僅兩家推出修補。","metaTitle":"Plugin4Shell：四款 AI 程式代理零點擊 RCE","metaDescription":"Air Security 的 Plugin4Shell 破解 Claude Code、Codex、Copilot 與 Gemini CLI 的外掛 SHA 釘選。Anthropic 與 OpenAI 已修補，Microsoft 尚未處理。"}],"celebrities":[{"id":"0632936d-a299-490f-b5e5-dfa87ba3eaa0","nameKo":"Anthropic","nameEn":"Anthropic","slug":"anthropic","profileImage":"https://ui-avatars.com/api/?name=Anthropic&size=400&background=84CC16&color=fff&bold=true"},{"id":"b086135e-3126-46cd-b591-67f073dff1bb","nameKo":"OpenAI","nameEn":"OpenAI","slug":"openai","profileImage":"https://ui-avatars.com/api/?name=OpenAI&size=400&background=F97316&color=fff&bold=true"},{"id":"4c975e87-2b02-46f5-a78d-1c8fc008bab7","nameKo":"깃허브","nameEn":"GitHub","slug":"github","profileImage":null},{"id":"5c572908-2f5b-47b3-95e2-13ed3e298bf7","nameKo":"구글","nameEn":"Google","slug":"google","profileImage":null}]}]}],"$L20"]]}]

#plugin4shell

Plugin4Shell: un RCE sin un solo clic golpea a Claude Code, Codex, Copilot y Gemini CLI

Suscríbete al Boletín

#plugin4shell

Plugin4Shell: un RCE sin un solo clic golpea a Claude Code, Codex, Copilot y Gemini CLI