Plugin4Shell: What a Zero-Click RCE Two Vendors Won't Patch Means for Your AI Coding Stack

If your engineering team runs Claude Code, Codex, GitHub Copilot, or Gemini CLI, a plugin you installed months ago — and haven’t touched since — may not be running the code you approved. In September 2026, researchers at Air Security disclosed Plugin4Shell, a zero-click remote code execution flaw that hits all four of the industry’s most widely used AI coding agents at once. It doesn’t touch the model at all. It breaks the one supply-chain control every security team assumed was solid: pinning a plugin to a specific, reviewed commit hash.

What makes Plugin4Shell worth stopping for isn’t just the blast radius — it’s what happened after disclosure. Two vendors shipped fixes. One went silent. One is retiring the affected product rather than fixing it. If your organization has quietly standardized on any of these tools over the past year, that split response is now your problem to manage, not theirs. This post walks through what the flaw actually does, why it qualifies as zero-click, where each vendor landed, and what to change this week regardless of what your vendor decides to do.

What Plugin4Shell Actually Is

Modern AI coding agents let teams extend them with third-party plugins — skills, tool integrations, custom commands — pulled from a marketplace or a git repository. To keep that supply chain trustworthy, agents pin an installed plugin to a specific 40-character commit SHA, the same integrity mechanism package managers have used for years: you don’t just trust a tag or branch name, you lock to the exact reviewed commit.

Air Security found that the four major agents check out the pinned SHA but never verify that the code actually sitting in the working tree afterward matches that hash. As the researchers put it, the agents “fetch that snapshot but never check that the code they end up with actually matches it” — a one-line verification gap with an outsized blast radius.

Two attack vectors, one root cause

For Claude Code, Codex, and GitHub Copilot, the exploit abuses how Git resolves references. If an attacker who controls the plugin’s repository creates a branch whose name is identical to the pinned commit hash, Git prioritizes the branch reference over the commit object during checkout. The agent asks for commit abc123..., Git hands back the attacker’s branch instead, and the agent reports a successful, verified install — because from its point of view, nothing looks wrong.

Gemini CLI has its own variant: the agent fetches the target commit into FETCH_HEAD, but if the attacker’s repository has a branch literally named FETCH_HEAD on its default branch, git checkout FETCH_HEAD resolves to that branch instead of the fetched commit, silently discarding the version the agent thought it just downloaded.

Why “zero-click” isn’t an exaggeration

The exploit doesn’t need a developer to approve anything. Agents routinely auto-update installed plugins in the background — that’s the entire point of a plugin ecosystem. An attacker publishes a clean, trustworthy plugin first, waits for a legitimate version bump to get pinned, then stages a malicious branch under that new commit’s name. The next scheduled auto-update silently swaps in the attacker’s code. No prompt, no diff review, no click. Security outlets tracking the disclosure noted proof-of-concept exploits worked against all four agents, which is what pushed this past “notable bug” into “coordinated multi-vendor disclosure” territory.

This is a different failure mode than the one behind GhostApproval, the symlink flaw disclosed in six coding assistants back in July, where the weak point was a human approval prompt that lied about which file was being written. Plugin4Shell doesn’t need a human in the loop to fool at all — it targets the automated trust chain sitting behind the plugin marketplace, the same layer this publication flagged as under-governed in our look at credential leaks across AI agent skill marketplaces.

The Patch Divide: Who Fixed It and Who Didn’t

Air Security disclosed the flaw to all four vendors in June 2026 after finding it in May. What happened next is the part enterprise buyers should sit with:

• Anthropic patched Claude Code in version 2.1.179, shipped ahead of the September 17 public disclosure.
• OpenAI patched Codex in version 0.146.0, with the fix verified by August 12, 2026.
• Microsoft has not shipped a fix for GitHub Copilot. As of the September disclosure, Microsoft had confirmed the issue was “under active investigation” but gave no remediation timeline, and had not published a security advisory.
• Google isn’t patching Gemini CLI at all. This isn’t a fresh decision made in response to Plugin4Shell — Google had already announced in May 2026 that it was retiring the standalone CLI in favor of a new Antigravity agent, with individual and free-tier access cut off on June 18, 2026, months before Air Security’s disclosure. Organizations on a Gemini Code Assist Standard or Enterprise license still retain CLI access today, but Google hasn’t stated whether that continued access includes a fix for this specific flaw, leaving affected orgs to migrate to Antigravity (which has no plugin SHA-pinning mechanism to exploit) as the only confirmed way to close the gap.

GitHub does offer a partial mitigation for its own hosted repositories: it blocks users from creating branch or tag names that resemble commit SHAs, which closes the specific Vector 1 exploit path for anything hosted directly on GitHub. But plugin marketplaces for these agents routinely point at other git hosts — Bitbucket among them — where no such restriction exists, so the protection doesn’t extend to the ecosystem as a whole.

That’s the real headline here, and it’s not really a story about Git internals. It’s a story about four vendors receiving the identical disclosure on the identical timeline, and two of them treating “ship a fix” as optional. We made a similar point in our analysis of the enterprise vendor pattern: a security incident tells you less about a vendor than what they do in the weeks after disclosure.

What This Means If You’ve Already Standardized on One of These Agents

Enterprise AI coding tool adoption has moved fast enough that most engineering orgs now run at least one of these four agents in production, often with plugin marketplaces enabled by default to boost productivity. Plugin4Shell means the plugin layer — not the model, not the prompt — is the part of that stack an attacker can reach without your developers doing anything wrong.

If you’re running Claude Code or Codex, the fix is straightforward: confirm you’re on the patched build (2.1.179+ and 0.146.0+ respectively) and treat any plugin auto-update from before the patch as unverified. If you’re running Copilot or Gemini CLI, you don’t have that option, which changes the calculus. A vendor that won’t commit to a patch timeline is a vendor whose plugin ecosystem you have to govern yourself — pin to known-good commits manually, disable background auto-updates for third-party plugin sources, and restrict installs to marketplaces hosted where hash-shaped branch names are blocked. This is the same governance gap we’ve written about before when evaluating what actually ports between agent plugin ecosystems: the portability conversation and the trust conversation turn out to be the same conversation.

Air Security’s own recommendation for vendors is worth repeating to your own tooling team if you build internal agent integrations: “the fix has to ship in the agent” itself, because pin resolution happens client-side — no marketplace-level control can substitute for the agent verifying what it actually checked out.

A Practical Response Checklist for This Week

1. Inventory which of the four agents are installed across your engineering org, including shadow adoption outside sanctioned tooling.
2. Patch Claude Code to 2.1.179+ and Codex to 0.146.0+ immediately if you haven’t already — this is a same-day fix, not a sprint item.
3. Freeze third-party plugin auto-updates for Copilot and Gemini CLI until your team can manually verify pinned commits match working-tree contents.
4. Restrict plugin sources to git hosts that block hash-shaped branch or tag names, and treat marketplaces on other hosts as higher risk until vetted.
5. Escalate internally with your Microsoft and Google account teams — a documented remediation timeline is a reasonable ask given the disclosure is now public, and vendor responsiveness here is a fair input into your next renewal conversation.

None of this requires waiting on a vendor. The point of a supply-chain flaw like Plugin4Shell is that the mitigation lives with whoever operates the plugin pipeline — and until a vendor patches, that’s you.

Frequently Asked Questions

What is Plugin4Shell in simple terms?

It’s a security flaw that lets someone who controls a plugin’s code repository silently swap in malicious code, even when an AI coding agent thinks it has locked that plugin to a specific, reviewed version. It works because the agents check out a pinned commit hash but never confirm the code they end up with actually matches that hash.

Which AI coding agents are affected?

Anthropic’s Claude Code, OpenAI’s Codex, GitHub Copilot, and Google’s Gemini CLI. Claude Code and Codex have been patched (versions 2.1.179 and 0.146.0 respectively). Copilot remains unpatched as of this writing, and Gemini CLI will not be patched because Google is retiring the product.

Do I need to click or approve anything for this exploit to work?

No. That’s what makes it zero-click. The malicious swap happens during a routine, automated plugin update in the background, with no approval prompt or file diff shown to the developer.

Is this the same issue as GhostApproval?

No. GhostApproval, disclosed in July 2026, exploited a symlink weakness in the human approval prompt itself. Plugin4Shell targets the automated plugin update pipeline and doesn’t rely on a human approving anything, so it’s a distinct vulnerability with a different root cause, even though several of the same vendors are affected by both.

What should we do if we’re on GitHub Copilot and can’t wait for a patch?

Manually verify that installed plugins’ working-tree code matches their pinned commit hash, disable auto-updates for any plugin source hosted outside GitHub itself (since GitHub blocks the specific branch-naming trick this exploit relies on), and restrict new plugin installs to marketplaces you’ve reviewed directly.

Has this been assigned a CVE number?

No CVE had been published in the public disclosure as of this writing; the vulnerability is being tracked under the name Plugin4Shell across vendor advisories and security reporting.

Sources

• Plugin4Shell - Zero Click RCE Vulnerability found in top 4 most popular coding agents - Air Security’s original technical disclosure and vendor mitigation guidance.
• Plugin4Shell Lets Repository Owners Swap Pinned Plugin Code Across Four AI Coding Agents - The Hacker News coverage of the disclosure, researchers, and affected versions.
• Zero-click RCE vulnerability hit four major AI coding agents, two remain unpatched - Help Net Security on vendor patch status and Microsoft’s response.
• Plugin4Shell Zero-Click RCE Hits Claude Code, Codex, Copilot and Gemini CLI - Additional technical breakdown and proof-of-concept confirmation across all four agents.
• Plugin4Shell Bypasses SHA Pinning Across All Four Major AI Coding Agents - Coverage of the SHA-pinning bypass mechanism.
• GhostApproval symlink flaws could let AI coding agents write to unintended files - Background on the related July 2026 disclosure affecting six coding assistants.