A zero-click vulnerability allowing remote code execution impacts major AI coding agents. The flaw affects Anthropic’s Claude Code, OpenAI’s Codex, Google's Gemini CLI, Microsoft’s Copilot, and Microsoft-owned GitHub Copilot. Researchers state this issue could grant attackers full access to every asset and data point the agent can reach.
Threat hunters at enterprise AI security startup Air discovered the exploit and dubbed it Plugin4Shell. They describe it as a first-of-its-kind AI supply-chain attack. Instead of targeting the model or agent directly, Plugin4Shell targets trusted marketplaces that host plugins for major coding agents. This approach could potentially reach millions of users and machines.
Microsoft data indicates that almost 90 percent of Fortune 500 companies use Copilot. Microsoft is one of two vendors that did not ship a patch for the flaw. Air researchers Or Nevo, Dor Granat, and Niv Hoffman stated in a Thursday report that the fix must ship in the agent, and updating is the only complete mitigation where one exists.
The Air team reported the security issue to all four vendors in June. Anthropic and OpenAI patched the vulnerability in Claude Code 2.1.179 and Codex 0.146.0, respectively. Google deprecated the Gemini CLI and informed Air it will not patch the software, leaving every install vulnerable. Google suggests users migrate to its newer Antigravity agentic development environment, which is protected from the attack.
Microsoft did not fix the flaw in Copilot. A GitHub spokesperson told reporters that Plugin4Shell attacks do not affect GitHub. The spokesperson stated that to prevent abuse of SHAs, GitHub does not allow users to create branch or tag names that resemble commit SHAs, ensuring the vulnerability cannot be exploited on GitHub.
The Air researchers stated that the GitHub mitigation is insufficient to defeat Plugin4Shell attacks. The team noted that marketplaces can also be hosted on other platforms such as Bitbucket. Microsoft Copilot remains vulnerable because it supports marketplaces from such platforms. Air reported the same issue to Microsoft in June, but did not receive a response due to high disclosure volume. Redmond did not immediately respond to requests for comment.
The security hole exists in how agents enforce marketplaces’ SHA-pinning mechanism. This mechanism locks agent plugins and skills to a specific, immutable commit hash instead of a mutable reference like a version tag or branch name. The design aims to prevent supply chain attacks so that if a public skill repository is compromised, an AI agent continues running the audited code hash used during pinning instead of automatically pulling malicious payloads.
Researchers describe the vulnerability as a plugin SHA-pinning bypass. The researchers wrote that the agent checks out the exact commit the marketplace pinned but never verifies it landed there. An attacker controlling the plugin repository makes the checkout resolve to malicious code while the pin still appears honored, resulting in zero-click remote code execution.
The auto-update feature of agent plugins enables the zero-click nature of the attack. When a pinned commit is swapped upstream, the agent’s plugin replaces itself with a malicious version. Both Claude and Codex automatically update installed plugins by default.
Researchers outlined two ways attackers could abuse this flaw. In the first scenario, an attacker submits a benign plugin to a trusted marketplace, passes review, and later replaces the benign content with malicious code. The second attack involves hijacking a legitimate author repository and pushing the malicious version onto every agent that has it installed, bypassing the SHA-pinning safety mechanism.
The Air team demonstrated this takeover style in earlier SkillJacking and RepoJacking proof-of-concept attacks. The researchers wrote that the chain is proven end to end, showing that takeovers happen at scale and Plugin4Shell defeats the mechanism built to contain them.
Updating the affected AI coding agents where patches are available remains the primary mitigation for users.
