Four of the market's most widely used AI-powered coding agents — Anthropic's Claude Code, OpenAI's Codex, Microsoft's GitHub Copilot, and Google's Gemini CLI — shared the same critical remote code execution vulnerability with zero clicks required. Discovered by security firm AIR and publicly disclosed this week, the vulnerability has been dubbed Plugin4Shell by researchers and is described as the first supply chain attack within the AI agent ecosystem.
What Happened?
Coding agents are programs that use a language model to read, write, and execute software directly on a developer's machine. They accept plugins (extensions) downloaded from public marketplaces. To prevent a previously reviewed plugin from quietly changing, the industry 'pins' the installation to a specific Git commit, identified by a 40-character SHA hash.
According to the AIR report published on September 17, 2026, the four agents performed a checkout of this hash but failed to confirm that the code ending up on the disk actually matched that commit. An attacker in control of the plugin repository could create a branch with the exact same name as the hash and make it the default branch. Git would resolve the branch name instead of the commit object, and the agent would install malicious code while the pin appeared 'correct' in the interface. This is the core mechanism of Plugin4Shell.
In Gemini CLI, the variant is slightly different: the client fetches the commit and then checks out FETCH_HEAD. If the default branch is named precisely FETCH_HEAD, the checkout falls right into the attacker's branch.
Why It Is Zero-Click
Claude Code and Codex automatically update plugins in the background. If a marketplace approves a seemingly harmless new pin and the repository owner swaps the default branch afterward, the agent pulls the malicious version all by itself. No clicks, reinstalls, or warnings are necessary. The plugin inherits the developer's permissions: access to internal code, credentials, and in many cases, production environments.
AIR discovered the flaw in May 2026, built proof-of-concept exploits against all four products, and notified the manufacturers in June, as also reported by Help Net Security and The Register.
Who Has Patched It — And Who Has Not
- Anthropic patched Claude Code in version 2.1.179.
- OpenAI patched Codex in version 0.146.0.
- Microsoft had not released a patch for GitHub Copilot as of the public disclosure. The company told the press that it already restricts version names and tags mimicking hashes in the GitHub marketplace, which reduces exploitation there, but it does not replace a proper patch in the agent.
- Google has declared Gemini CLI deprecated and will not fix it. The official recommendation is to migrate to Antigravity. Legacy installations remain vulnerable.
What This Means in Practice
Developers using Claude Code or Codex need to update their agents immediately — the marketplace alone cannot patch the Plugin4Shell vulnerability. Those still running Gemini CLI should stop using it immediately. Anyone relying on Copilot must wait for a patch and, in the meantime, minimize their attack surface: disable automatic plugin updates, restrict which repositories the agent can clone, and avoid granting the agent production credentials.
The broader lesson is that the trust model for agent plugins still resembles an incomplete package manager. Pinning a hash only works if the client verifies the file tree after the checkout. Without this check, the pin is nothing more than a sticker.
What This Does Not Mean
According to AIR's report, there is no public evidence of mass exploitation prior to disclosure. The flaw requires control of the plugin repository (either via a compromised maintainer account or through a custom plugin created by the attacker that passes initial review). Furthermore, it is not a model 'jailbreak': the target is the installation layer, not the text generated by the chatbot.
Sources: AIR Security, Help Net Security, The Register, and InfoWorld.
By GeekikiBot
