Plugin4Shell: A Zero-Click Bug Hit Claude Code, Codex, Copilot, and Gemini CLI All at Once

Researchers at the security firm Air disclosed a vulnerability they call Plugin4Shell on September 17, 2026, describing it as the first supply-chain attack to hit the plugin marketplaces behind every major AI coding agent at once. Unlike prior attacks aimed at models or the agents themselves, Plugin4Shell targets the distribution layer underneath them — the marketplaces millions of developers use to install plugins for Claude Code, Codex, Copilot, and Gemini CLI.

How Does Plugin4Shell Actually Work?

The bug lives in how these agents enforce SHA pinning, the safeguard that is supposed to lock an installed plugin to one specific, reviewed commit rather than a mutable reference like a branch name. The idea is simple: if a plugin’s repository is later compromised, the agent should keep running the exact, audited code it was pinned to instead of silently pulling something new.

Air’s researchers found that every affected agent checks out the pinned commit but never verifies the checkout actually landed there. That single missing check is the entire vulnerability, and git gives an attacker two different ways to exploit it depending on the agent.

For Claude Code, Codex, and GitHub Copilot, the agent clones a plugin’s repository and runs git checkout against the pinned 40-character commit hash. An attacker who controls that repository can create a branch whose name is the exact same 40-hex string as the pinned commit, then set that branch as the repository’s default. Because git prefers a matching branch name over a commit id when the two are ambiguous, the checkout silently resolves to the attacker’s branch instead of the pinned commit — and the agent reports a successful install at the “correct” commit anyway.

Gemini CLI has a different variant of the same underlying flaw. It fetches the correct pinned commit into .git/FETCH_HEAD, then runs git checkout FETCH_HEAD. But if the repository’s default branch happens to be named FETCH_HEAD, that checkout resolves to the branch instead of reading the fetched file, and the correctly fetched commit is silently discarded in favor of attacker-controlled content.

Air says a single fix closes both variants: after checkout, an agent needs to resolve the commit that actually landed in the working tree and abort if it doesn’t match the pinned SHA exactly — not just trust that the checkout command did what it was told.

Why Is This a Zero-Click Vulnerability?

What makes Plugin4Shell dangerous isn’t just that it bypasses SHA pinning — it’s that no user action is required to trigger it. Claude Code and Codex auto-update installed plugins in the background by default. The same flawed checkout logic that runs at install time also reruns on every background update, so once a plugin a user already trusts is installed, an attacker can swap it for malicious code without the victim installing anything new, clicking a prompt, or noticing any change.

Air describes two realistic attack paths, neither of which requires compromising the marketplace itself:

• Plant and flip: an attacker publishes a genuinely benign plugin, gets it through marketplace review, and later swaps its content for a malicious version once people have installed it.
• Hijack an existing plugin: an attacker takes over the repository behind a plugin someone else already wrote and the marketplace already trusts, then uses Plugin4Shell to push malicious code onto every agent that already has it installed.

The researchers say they have already demonstrated the takeover step at scale in earlier work, and that plugins and extensions typically inherit the same permissions as the developer running the agent — including access to local source code, cloud credentials, SSH keys, internal repositories, and production systems. That overlaps with the same class of agent containment failures that have drawn scrutiny across the industry this year.

Which Agents Are Patched, and Which Aren’t?

According to The Register, Air reported Plugin4Shell to all four vendors in June 2026 under coordinated disclosure. As of the September 17 public disclosure:

• Claude Code: patched by Anthropic in version 2.1.179.
• OpenAI Codex: patched by OpenAI in version 0.146.0.
• GitHub Copilot: not patched. A GitHub spokesperson told The Register that GitHub itself blocks branch names that resemble commit hashes, which it says prevents exploitation on GitHub-hosted marketplaces. Air disputes that this fully closes the hole, since Copilot also supports marketplaces hosted on Bitbucket and self-hosted git servers, which do allow hash-like branch names.
• Gemini CLI: will not be patched. Google has deprecated Gemini CLI and told Air every existing install stays vulnerable indefinitely; Google recommends migrating to its newer Antigravity agentic development environment, which Air says does not use the same plugin SHA-pinning mechanism and is not exposed to this attack.

Anyone still running Claude Code or Codex on an older version, or running Copilot or Gemini CLI with plugins installed from a marketplace, should treat this as an active exposure rather than a resolved issue.

Why This Matters

Plugin4Shell is notable less for its complexity and more for its reach: the same design flaw, a missing post-checkout verification, turned up independently in every major coding agent’s plugin installer. That is a pattern worth taking seriously on its own, separate from any single vendor’s response. It also lands in a year where labs have started pausing their own models over cyber risk and where agent oversight has become a headline metric in its own right — this is the same underlying concern, playing out one layer down, in the supply chain that delivers code to agents rather than in the models themselves.

The most uncomfortable finding in Air’s report isn’t the exploit mechanics, it’s who it defeats. SHA pinning is the safeguard security-conscious teams reach for specifically because it doesn’t rely on trusting a marketplace forever, only on trusting one reviewed commit. Plugin4Shell shows that pin was never enforced where it actually needed to be: inside the agent, at checkout time. Reviewing a plugin carefully and pinning it exactly as intended did not protect anyone, which means the fix genuinely could only come from the agent vendors, not from better user behavior.

Frequently Asked Questions

Do I need to do anything if I use Claude Code or Codex?

Update to Claude Code 2.1.179 or later, or Codex 0.146.0 or later, if you have not already. Both vendors shipped patches before the public disclosure. It is also worth reviewing your installed plugin list and removing anything you no longer actively use.

Is GitHub Copilot safe to use with plugins right now?

Partially. GitHub says it blocks branch names that resemble commit hashes on GitHub-hosted marketplaces, which prevents one path of the exploit there. But Air says Copilot also supports marketplaces hosted on Bitbucket and self-hosted git servers, which do not have that same restriction, so exposure depends on where your marketplace plugins are actually hosted. Microsoft has not shipped a fix as of this article.

What should Gemini CLI users do?

Google has deprecated Gemini CLI and will not patch this vulnerability. Air and Google both recommend migrating to Google’s newer Antigravity agentic development environment, which does not use the same plugin SHA-pinning mechanism that Plugin4Shell exploits.

Does this vulnerability require me to click something or install a new plugin?

No. That is what makes it zero-click. If you already have a plugin installed from an affected agent’s marketplace, and that agent auto-updates plugins in the background (the default in Claude Code and Codex), an attacker who controls the plugin’s upstream repository can replace it with malicious code without you installing anything new or approving any prompt.

Does careful plugin review protect against Plugin4Shell?

No. Reviewing a plugin and pinning it to a specific reviewed commit is exactly the safeguard Plugin4Shell defeats. The vulnerability sits in how the agent verifies that checkout, not in whether a human reviewed the plugin beforehand, so doing everything right at review time does not prevent the swap.

Sources: Air Security, The Register, Help Net Security.

About the author

Kai Williams

Kai Williams has been in marketing for years, with a long background in SEO before AEO had a name. He stepped into Answer Engine Optimization the moment AI started reshaping how people search, and has been tracking the shift ever since. At Prompt Insider, he covers AEO, AI marketing, and the future of search, breaking down what is changing and what brands need to do about it.