Plugin4Shell: The Zero-Click Flaw That Has Coding Agents Running Plugins Nobody Approved
Plugin4Shell is the flaw that let Claude Code, Codex, Copilot and Gemini CLI run a third party's plugin without checking that the code they downloaded really was the pinned commit. Having the plugin installed was enough: background auto-update did the rest.
What Plugin4Shell Is and Why It Matters
Security firm AIR disclosed on 17 September 2026 a remote code execution vulnerability affecting the four most widely used coding agents. The researchers describe it as the first supply chain vulnerability of the AI agent ecosystem, and the label points at its origin: it is not in the models or in how they respond, it is in how an agent installs and verifies a plugin.
A Remote Code Execution Flaw With No User Interaction
Zero-click means exactly that: the person does nothing. They do not open a file, approve a dialog or install anything. Simply having the plugin installed — and installed correctly, from a marketplace they trust, with the reviewed version pinned exactly as the security model intends — is enough to be exposed.
Who Found It and When
AIR found the bug in May 2026 and built working proof-of-concept exploits against all four agents. It reported the issue to each vendor in June with a roughly 90-day responsible disclosure window, and published once fixes were not complete across the board. No CVE identifier appears in the reviewed advisory.
Read also
How It Works, Step by Step
The mechanism fits into a chain of three links, and the third is the hardest one to accept.
What Pinning a Plugin by SHA Means and Why Everyone Trusted It
When you install a plugin, the agent pins it to a specific commit through that commit's SHA hash. That is the model's central guarantee: if a plugin passed review, that code cannot change without you knowing, because any alteration produces a different hash. The entire trust model of the plugin ecosystem rests on that promise.
The Broken Assumption: Git Resolves a Branch Before a Commit of the Same Name
The agent asked git for the pinned commit but never verified that the downloaded result really was that commit. Git resolves a reference or branch named like the hash first, and the pin still looked intact. With write access to the plugin repository, an attacker only had to create a branch named after the pinned SHA and push malicious code. The flaw works only where a branch can be named like a hash: GitHub rejects a 40-character hex branch name outright, while Bitbucket and any self-hosted git server allow it. Claude Code, Codex and Copilot share this version of the problem; Gemini CLI was exposed through a separate mechanism in how it fetched and checked out pinned commits, with the same outcome.
Background Auto-Update Does the Rest
The flaw is not only an install-time bug, which is what makes it zero-click: the same checkout re-runs on background auto-update, the default in Claude Code and Codex. When the marketplace moves the pinned SHA, the change reaches already-installed plugins with no user action at all. The code then runs with the agent's permissions — everything the agent can reach: repositories, project files, environment variables and development credentials. If the agent holds keys, the attacker gets the keys.
The Real Patch Status, One Vendor at a Time
The check that is missing runs inside the agent, not at the marketplace, so no marketplace can close the gap on its own. Updating the client is the only complete fix, and the picture is split:
- Claude Code: fixed from version 2.1.179.
- Codex: fixed from version 0.146.0.
- GitHub Copilot: no fix shipped. Part of the coverage places its vector in plugins served from third-party repositories such as Bitbucket.
- Gemini CLI: Google did not patch it, it deprecated it. Every existing install stays exposed indefinitely, and the official advice is to move to its newer agent, Antigravity, which was built without the plugin pinning system this attack relies on.
What to Do This Week, Depending on Your Setup
The concrete actions depend on which agent you use and how many plugins sit on top of it.
- On Claude Code or Codex: update and check the installed version. Older ones remain vulnerable.
- On Copilot: review which plugins you have and where they come from, uninstall the ones you do not use, and distrust background auto-update for third-party plugins.
- On Gemini CLI: migrate to another agent or accept the exposure.
- In general: cut the agent's permissions, use short-lived tokens and review its production access.
- And if you think it already happened: rotate the secrets the agent could reach and review its action history.
Not New: Supply Chain Strikes Again
The pattern is the familiar one: attack the link everyone trusts without checking. What changes is the consumer of the dependency. AIR's own research into the agent skills ecosystem found 925 skills that had been hijacked from their original maintainers and reached 134,000 agents, in a line of work the firm calls SkillJacking; in earlier research, a plugin they built spread to more than 26,000 agents before it was pulled. The practical takeaway from the finding is one sentence: verify the commit, not the name.
Conclusion
Plugin4Shell puts a finger on an assumption the ecosystem treated as solved and that never was: pinning a plugin's version means nothing if nobody checks which code arrived. It is fixed in two of the four agents and unfixed in the other two, so the useful action is concrete and due this week — update where a patch exists and cut exposure where it does not. The blog has covered cases of the same kind before, including OpenAI agents attacking RubyGems, the critical GitLab CVE and the comparison of AI code editors.
