Plugin4Shell: Zero-Click RCE Hit All Four Major Coding Agents — Two Are Still Unpatched

The plugins marketplace was supposed to be the safe way to extend your coding agent: every plugin pinned to a reviewed commit SHA, so a repo takeover couldn’t silently change what you run. That guarantee is broken. On September 17, researchers at Air Security disclosed Plugin4Shell, a zero-click remote code execution flaw affecting Anthropic’s Claude Code, OpenAI’s Codex, GitHub Copilot, and Google’s Gemini CLI — a shared implementation mistake replicated across all four codebases.

The bug is a plugin SHA-pinning bypass. Each agent checks out the marketplace-pinned commit but never verifies the checkout actually landed there. Because git resolves a ref before a commit object of the same name, an attacker who controls a plugin repo can create a branch whose name matches the pinned 40-character commit hash and point it at malicious code. The agent installs the attacker’s code while the pin still looks honored. Air built working proof-of-concept exploits against all four agents in May and disclosed the flaw to vendors in June.

Why it’s zero-click

Install-time isn’t the only attack surface. As Air documents, the same git checkout re-runs on background plugin auto-update — the default in Claude Code and Codex — so when the marketplace bumps a pinned SHA, the swap reaches already-installed plugins with no user action. A plugin runs with the same privileges as the developer using the agent, which means the swapped code can reach their files, saved credentials, and anything they can log in to. Air calls it “the first supply chain vulnerability of the AI agent ecosystem”, and claims its scan found 925 skills already in active use that had been hijacked, reaching some 134,000 agents.

Patch status: half the industry fixed, half hasn’t

Anthropic shipped a fix in Claude Code 2.1.179 and OpenAI patched Codex in 0.146.0. The other two are a different story. GitHub Copilot has no agent-side fix: GitHub blocks SHA-shaped branch names on its own platform, but Air points out Copilot supports non-GitHub git hosts where the trick still works. Google told Air it will not patch Gemini CLI at all, since the product is deprecated; users are being routed to Antigravity instead. As of September 18, no CVE had been assigned and there was no reported in-the-wild exploitation — but the exposure window is everyone running a pinned plugin they thought was locked down.

The practical takeaway is narrow and urgent: update Claude Code past 2.1.179 and Codex past 0.146.0, audit your installed plugins, and consider turning off auto-update until the pin story is trustworthy again. Copilot users pulling plugins from non-GitHub marketplaces should assume extra risk until Microsoft ships a client fix. The uncomfortable lesson is that the same shared marketplace infrastructure the whole agent ecosystem copied from one another carried the same bug in all of them.