A Zero-Click Flaw Let Malicious Plugins Run Code in Four Major AI Coding Agents

Security researchers at Air published details on September 17, 2026 of a vulnerability they call Plugin4Shell, a zero-click remote code execution flaw in the plugin systems of four widely used AI coding agents. The affected products are Anthropic's Claude Code, OpenAI's Codex, GitHub Copilot and Google's Gemini CLI. An attacker who controls a plugin repository can make a developer's machine run malicious code without any user action, and two of the four products remain unfixed.

Related reading: Mistral Vibe Ran a Repository's Git Hooks Before Trust Checks, Enabling RCE · AI-Found Rejetto HFS Authentication Bypass Draws Exploitation Attempts.

The name echoes Log4Shell, though the comparison is about impact rather than mechanism. Where Log4Shell exploited a logging library that was everywhere, Plugin4Shell exploits the way agents install and update the add-ons that extend them. Air describes it as the first supply chain vulnerability of the AI agent ecosystem.

Who patched and who did not

The vendors responded differently after Air disclosed the flaw in June 2026 under coordinated disclosure. Anthropic confirmed a fix in Claude Code 2.1.179 on June 17, 2026. OpenAI verified a fix in Codex 0.146.0 on August 12, 2026.

Microsoft has not shipped a patch for Copilot. GitHub, which Microsoft owns, told The Register that Plugin4Shell does not affect GitHub because the platform blocks branch and tag names that look like commit hashes. Air disputes the scope of that defense. The researchers point out that Copilot supports marketplaces hosted on other platforms, including Bitbucket and self-hosted Git servers, which do not impose the same restriction. Air said it reported the issue to Microsoft in June and received no response.

Google took a different path. It deprecated Gemini CLI and told Air it will not patch it, which leaves every existing installation exposed. Google is directing those users to Antigravity, its newer agentic development environment, which does not use the plugin pinning system the attack relies on.

The bug is a missing check

AI coding agents let users extend them with plugins and skills, and most people install those add-ons from community marketplaces rather than a vetted enterprise store. A plugin runs with the privileges of the person using the agent, which means it can reach the same repositories, credentials, files and production systems that the developer can reach.

Marketplaces use a safeguard called SHA pinning. When a plugin passes review, the marketplace records the exact Git commit that was reviewed, and the agent is supposed to install that commit and nothing else. Pinning is the reason a reviewed plugin can be trusted to stay reviewed.

Air's researchers found that the agents check out the pinned commit but never verify that the code they ended up with matches the pinned hash. That gap is the entire vulnerability. An attacker who controls the plugin's repository can create a branch whose name is exactly the 40-character hexadecimal string of the pinned commit, make that branch the repository's default, and point it at malicious code. When the agent runs git checkout on the pin, Git resolves the name to the branch rather than the original commit, because Git prefers a reference over an object identifier when the two collide. The agent reports a successful install at the pinned commit, and the pin still looks honored.

GitHub blocks branch names that resemble commit hashes, which is why the company says its own platform is not affected. Bitbucket and self-hosted Git servers generally allow them, and those are supported marketplace backends. Anthropic's own documentation lists Bitbucket and self-hosted Git as valid marketplace hosts, according to Air.

Gemini CLI was vulnerable through a related but separate path. It fetched the pinned commit and then ran git checkout FETCH_HEAD, so an attacker could name the repository's default branch FETCH_HEAD and have the checkout resolve to attacker-controlled content while the fetched commit was discarded.

Why no click is required

The flaw would be serious even if it required a developer to install something new. What makes it zero-click is plugin auto-update. Claude Code and Codex update installed plugins in the background by default. When a pinned commit is swapped upstream, the change reaches every machine that already has the plugin installed, with no install step, no prompt and nothing to notice.

Air describes two routes to that position. In the first, an attacker publishes a genuinely benign plugin, waits for it to pass review and be pinned, then replaces the content afterward. In the second, the attacker hijacks a legitimate author's repository and pushes the malicious version to every agent that has the plugin installed. Air said it demonstrated both the marketplace intrusion and the repository takeover in earlier research.

The impact is broad because the agent is not sandboxed from the developer's work. A successful exploit gives the attacker full remote code execution on the host and access to everything the agent can reach. Air noted that organizations which review plugins and pin them themselves are not protected, because the flaw lives in the agent's enforcement of the pin, not in the marketplace that issued it.

A supply chain problem the marketplaces cannot fix

Because the pin is resolved inside the agent, Air argues that no marketplace can close the gap on its own. A marketplace can reduce one variant of the attack by allowing only hosts that reject SHA-shaped branch names, which in practice means GitHub-only, but that would exclude host types the agents officially support and would not address the Gemini CLI variant. The fix has to ship in the agent, which is why updating is the only complete mitigation where one exists.

The disclosure lands during a broader reckoning with agentic security. In July 2026, OpenAI disclosed that models under evaluation escaped intended controls and compromised parts of Hugging Face's systems, and in September it published a framework for reporting model misalignment after disclosing six additional incidents. Those events involved agents acting against their operators. Plugin4Shell is different: it turns the distribution layer for agent add-ons into the attack surface, which means the risk travels to every developer who trusted a marketplace.

Air's earlier work points in the same direction. The company has published research on a malicious skill that spread to more than 26,000 agents, on 925 skills hijacked from their maintainers that affected 134,000 agents, and on 155 hijackable servers in the official MCP marketplace. Each case exploits trust in a distribution channel rather than a flaw in a model.

What defenders should do

For Claude Code and Codex users, the action is an update. Version 2.1.179 or later closes the flaw in Claude Code, and version 0.146.0 or later closes it in Codex. Air said enterprises using its own marketplace and filtering products were not affected.

For GitHub Copilot there is no patch, so the available steps are to audit installed plugins, remove ones that are not actively used, and consider disabling auto-update until Microsoft ships a fix. For Gemini CLI, the recommendation is to migrate to Antigravity. Google has said it will not patch the deprecated tool.

The wider lesson concerns how much trust enterprises place in plugin review. Pinning was meant to make a marketplace review durable, and it did not. Security teams that assumed an approved plugin could not change underneath them now have a reason to verify what agents actually execute on developer machines.

What to watch

Three things will show whether the industry treats this as a one-off or a structural problem. The first is whether Microsoft patches Copilot and whether it does so in the agent or relies on the GitHub branch-name restriction. The second is whether marketplaces introduce independent verification of what they distribute, rather than depending on a check that runs on the client. The third is whether the growing market for agent add-ons adopts the same kind of software bill of materials and provenance tooling that conventional software supply chains have spent a decade building.

For now, the practical picture is uneven. Two of the largest AI coding agents have a fix, one has none, and one has been retired rather than repaired. Millions of developers run these tools with plugins they installed and forgot about, which is exactly the condition Plugin4Shell needs.

Cover: TechPastWeek composite of public-domain wordmarks for Claude, OpenAI, GitHub Copilot and Google Gemini (Wikimedia Commons), shown on the site's dark gradient.