Plugin4Shell: The Zero-Click Hack That Hits Claude Code, Copilot, Codex and Gemini CLI

Introduction: Your Coding Agent's Supply Chain Has a Hole

If you use Claude Code, GitHub Copilot, OpenAI's Codex, or Gemini CLI with plugins from a marketplace, security researchers have some uncomfortable news for you this week. A startup called AIR disclosed a vulnerability it calls Plugin4Shell — a zero-click remote code execution (RCE) flaw that affects all four of the major AI coding agents at once, and two of them were still unpatched as of the September 18 disclosure.

The name is a deliberate echo of Shellshock and Log4Shell — the class of infrastructure bugs that quietly sat in software everyone uses until someone proved they were weaponizable. AIR, which focuses on protecting enterprise AI agents, calls Plugin4Shell "a first-of-its-kind AI supply-chain attack," and the mechanics bear that out: it doesn't target the AI model, the prompt, or even the agent itself. It targets the plugin marketplaces that have quietly become the package registries of the AI coding era.

What Is Plugin4Shell?

Modern AI coding agents extend their capabilities through plugins — bundles of commands, tools, and integrations that let the agent do everything from querying databases to deploying infrastructure. Marketplaces for these plugins work a lot like app stores or npm: developers publish, users install, and the security model rests on a key assumption — that what you reviewed is what you run.

To enforce that, marketplaces use SHA pinning: when a plugin is reviewed and added to a marketplace, the exact commit hash (SHA) of the reviewed code is recorded, and the agent is supposed to check out precisely that commit. Plugin4Shell breaks that guarantee. As AIR researchers Nevo, Granat, and Hoffman explained, "the agent checks out the exact commit the marketplace pinned but never verifies it landed there, so an attacker who controls the plugin's repo makes the checkout resolve to malicious code while the pin still looks honored."

In other words: the security check runs, the pin "passes," and the agent happily executes code the marketplace never reviewed.

How the SHA-Pinning Bypass Works

The technical core is a gap between what the agent asks Git to do and what Git actually does:

• Claude Code, Codex, and GitHub Copilot pass the pinned SHA directly to Git for checkout — but never verify afterward that Git actually checked out the commit corresponding to that SHA. An attacker who controls the plugin's repository can create a malicious version of the repo and name a branch or tag using the SHA of the legitimate commit as its name. The checkout resolves to the attacker's code while the pin still appears honored.
• Gemini CLI has a variant of the same problem: an attacker publishes a malicious plugin version named to match the FETCH_HEAD reference Git returns, and the CLI resolves to the malicious copy instead.

Two details make this genuinely dangerous rather than merely clever.

First, it's zero-click. The same git checkout re-runs during background auto-update — the default behavior in Claude Code and Codex. So when a marketplace bumps the pinned SHA (or an attacker forces it to), the malicious swap reaches every already-installed plugin with no user action at all. You did everything right: you installed from a trusted marketplace, the plugin was reviewed, the commit was pinned. The swap still reaches you.

Second, attackers have two doors in. They can publish a plugin that behaves exactly as advertised and turn it malicious later — AIR previously demonstrated this by building a plugin that spread to more than 26,000 agents before being pulled. Or they can take over the repository behind a plugin that users already know and trust, then use the same bypass to push malicious code to everyone who has it installed. As AIR put it: "takeovers happen at scale, and Plugin4Shell defeats the mechanism built to contain them."

Who Is Affected — and Who Has Patched

The vulnerability was discovered in May and disclosed to vendors in June, with public disclosure on September 17. The vendor response has been uneven:

Researchers note GitHub's mitigation alone isn't sufficient to fully defeat Plugin4Shell-style attacks, since repository takeovers can occur outside what platform-level restrictions cover.

Why This Is Worse Than a Normal Vulnerability

A malicious plugin in a coding agent doesn't just crash your IDE — it inherits everything the agent can touch:

• Your source code, including proprietary codebases the agent reads and writes all day
• Credentials: API keys, cloud tokens, and secrets the agent uses for deployments and integrations
• Cloud systems and CI/CD pipelines that developers connect their agents to
• Everything the developer can access, because plugins mostly run with the same permissions as the human

Analyst Pareekh Jain of Pareekh Consulting flagged the practical exposure: enterprises running AI coding agents with third-party plugins — especially agents wired into source code, credentials, cloud systems, or CI/CD — are the most at risk, and many are likely running unpatched versions right now. The result can be anything from stolen API keys to backdoored repositories to a foothold that reaches deeper into corporate infrastructure.

How to Protect Your Development Environment

The uncomfortable truth is that the ecosystem's security model — "marketplace review + SHA pinning" — was the industry's answer to agent plugin risk, and Plugin4Shell shows it can be bypassed end to end. Until agents cryptographically verify that the code they executed is the code that was pinned, treat every installed plugin as code running with your permissions, because it is.

The Bigger Picture: AI Supply Chain Attacks Go Mainstream

Plugin4Shell isn't happening in a vacuum. It's the latest entry in a rapidly growing file of attacks on the AI toolchain itself — from Cursor prompt-injection-to-RCE chains to git config attacks on agent repositories to the rogue-agent botnet found in a jailbroken Gemini CLI earlier this summer. As coding agents gained deep access to repositories, credentials, and CI systems in 2025 and 2026, they became the highest-value target in the development stack.

The pattern mirrors traditional software supply-chain security — which took a decade of npm/PyPI incidents, dependency confusion attacks, and Log4Shell before "software supply chain security" became a budget line. AI agents are compressing that timeline into months, because the attack surface arrived fully formed: marketplaces, auto-updates, and deep system access, all at once.

For teams choosing AI coding tools in 2026, security posture is now a first-class selection criterion alongside model quality and price. Ask vendors how they verify plugin integrity, whether auto-updates re-execute unreviewed code, and what sandboxing exists between plugins and your credentials. If you're evaluating agents, compare the security models of Claude Code, GitHub Copilot, OpenAI Codex, Gemini CLI, and Windsurf side by side — and browse the full catalog on aitrove.ai.

Frequently Asked Questions