A zero-click remote code execution flaw affects the four most widely used AI coding agents, Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI, letting an attacker who controls a plugin repository swap in malicious code while the agent reports the reviewed version was installed.
The vulnerability, named Plugin4Shell by researchers at security startup AIR, was disclosed publicly on September 18. AIR’s team, Or Nevo, Dor Granat and Niv Hoffman, found the bug in May 2026, built working proof-of-concept exploits against all four agents, and disclosed to each vendor in June 2026. Three months later, two vendors have shipped fixes, one has not, and one retired the affected product instead.
The flaw is a plugin SHA-pinning bypass. Agents install plugins with the equivalent of a git clone followed by a git checkout of a pinned 40-character commit hash, the mechanism meant to guarantee that a plugin runs exactly the code that was reviewed and approved. The agents never verify that the checkout actually landed on that commit.
An attacker who controls the upstream repository creates a branch whose name is the pinned SHA and makes it the repository’s default branch. When a name is both a valid ref and an object ID, git prefers the ref and prints only a “refname is ambiguous” warning. The working tree now contains attacker-controlled code, and the agent reports a successful install at the pinned commit. Because plugin auto-update runs in the background by default in Claude Code and Codex, the swap reaches already-installed plugins with no click, no prompt and nothing visible to the user. The attacker needs two conditions to hold: the host must allow a branch to be named like a hash, and that branch must be the repository’s default.
Vendor Status
| Agent | Vendor | Fix | Status |
|---|---|---|---|
| Claude Code | Anthropic | Patched in 2.1.179 | Update required |
| Codex | OpenAI | Patched in 0.146.0 | Update required |
| GitHub Copilot | Microsoft | No patch shipped | Vendor says host blocks it |
| Gemini CLI | Not patched, tool deprecated | All installs remain exposed |
Anthropic and OpenAI patched the flaw in Claude Code 2.1.179 and Codex 0.146.0 respectively. OpenAI’s release notes for Codex describe the fix as “Verify Git plugin SHA checkouts.” Google deprecated Gemini CLI for consumer accounts in June and told AIR it will not patch, so every existing install remains vulnerable, though the company points users to its newer Antigravity agentic development environment, which is not affected. Google continues to publish new Gemini CLI versions for enterprise Code Assist customers, which keeps the exposed population larger than the consumer retirement suggests.
Microsoft’s position is the most contested. A GitHub spokesperson said Plugin4Shell attacks do not affect GitHub because the platform does not allow users to create branch or tag names that resemble commit SHAs. The AIR researchers pushed back, noting that marketplaces can also be hosted on other platforms such as Bitbucket, where the branch-name trick works. “The fix has to ship in the agent, and updating is the only complete mitigation where one exists,” the team wrote in their report. Nearly 90 percent of Fortune 500 companies use Copilot according to Microsoft, which makes the unpatched status the most consequential of the four.
No CVE identifier has been assigned as of the disclosure date.
Why It Matters
The Register described Plugin4Shell as a “first-of-its-kind AI supply-chain attack.” Rather than targeting a model or an agent’s logic, the attack goes after the trusted marketplaces that host plugins for coding agents, which means a single compromised plugin repository could reach millions of developer machines. An agent with code execution has access to everything its operator has: source code, credentials in environment variables, cloud accounts, internal networks.
The pinning mechanism itself was the defense against exactly this class of attack. If a public skill repository is compromised, the agent should keep running the same audited code hash it was pinned to instead of pulling new payloads. Plugin4Shell defeats that guarantee without breaking the pin, which is what makes it notable: the security control reports success while failing. Enterprise security teams that relied on SHA pinning as their control point for third-party agent code now need a second mechanism, because the pin no longer proves anything on its own.
What Developers Should Do
AIR published detection guidance. A correctly pinned install leaves the plugin repository in a detached HEAD state at the recorded SHA. A checkout where HEAD points to a branch rather than a bare commit is the signal to investigate. Their check loops through the plugin directories used by Claude, Codex and Gemini, printing the resolved HEAD and whether it is detached. For repository owners, the flag to look for is any branch name matching a 40-character hex pattern or the literal string FETCH_HEAD, which is the sibling flaw in Gemini CLI’s three-step install process of clone, fetch origin and checkout FETCH_HEAD, where a default branch literally named FETCH_HEAD wins the same resolution race.
Updating Claude Code and Codex closes the hole for those two agents. For Copilot and Gemini CLI, the mitigation options are narrower: avoid plugins hosted outside GitHub, pin plugins to commits and verify the checkout manually, or move to an environment where the vendor has addressed the flaw. The episode is also a reminder that supply-chain security for AI agents is still being invented. The pinning systems in all four agents were built on the same incorrect assumption about git checkout semantics, which suggests the review processes that approved them shared the same blind spot. Vendors who ship agent plugin systems next will be auditing that assumption first.