Plugin4Shell Zero-Click RCE Hits Claude Code, Codex, Copilot and Gemini CLI

Plugin4Shell is a high-severity, zero-click remote code execution vulnerability affecting major AI coding agents, including Anthropic Claude Code, OpenAI Codex, GitHub Copilot, and Google Gemini CLI.

The flaw allows a malicious plugin update to execute attacker-controlled code without requiring a user to click, approve, or reinstall anything.

Plugin4Shell targets the software supply chain behind AI agents rather than the AI models themselves. Modern coding agents can install plugins, skills, and extensions from community marketplaces.

These add-ons often inherit the same permissions as the developer running the agent, including access to local source code, cloud credentials, SSH keys, internal repositories, production systems, and secrets.

The issue lies in the way affected agents handle SHA-pinned plugin versions. Marketplace systems commonly pin a plugin to a specific Git commit hash after it has been reviewed. This is intended to ensure the agent installs the exact approved code rather than a newer or modified version.

However, researchers at Air Security found that the affected agents request the pinned commit but fail to confirm that the checked-out working tree actually matches that commit.

An attacker who controls a plugin repository can exploit Git reference resolution to make the agent check out a malicious branch while still appearing to honor the approved SHA pin.

Plugin4Shell Zero-Click RCE

For Claude Code, Codex, and GitHub Copilot, the attack can involve creating a branch whose name matches the plugin’s 40-character commit hash.

Git may prioritize a matching reference name over the commit object during checkout. If the branch contains malicious code, the agent can install that code while reporting a successful installation based on the expected SHA.

Gemini CLI has a separate variant. Its plugin process fetches the intended commit and then checks out FETCH_HEAD. Researchers said an attacker can abuse a repository branch named FETCH_HEAD to redirect the checkout to malicious content rather than the fetched commit.

The vulnerability becomes zero-click because of automatic plugin updates. Claude Code and Codex update installed plugins in the background by default, according to the disclosure.

An attacker does not need to persuade a victim to install a new plugin. Instead, they could first publish a legitimate-looking plugin, gain adoption, and later modify the upstream repository.

Compromising an existing plugin maintainer’s repository could produce the same result. The risk is especially significant for enterprises using AI coding agents with broad access to development and production environments.

A successful exploit could give an attacker the same reach as the developer’s account, potentially exposing proprietary code, API keys, CI/CD credentials, internal systems, and cloud environments.

Anthropic fixed the issue in Claude Code version 2.1.179, while OpenAI patched Codex in version 0.146.0. Google said Gemini CLI is deprecated and will not receive a fix, advising users to migrate to Antigravity.

Microsoft had not issued a fix for Copilot at the time of disclosure. GitHub said its platform blocks SHA-like branch and tag names. However, Air Security argued that marketplaces hosted on services such as Bitbucket or self-hosted Git servers may remain exploitable.

Organizations should update Claude Code and Codex immediately, review plugin inventories, restrict plugin sources where possible, and monitor plugin repositories for unexpected branch changes or ownership transfers.

The core defense for vendors is to verify the actual checked-out commit after installation by comparing the resolved HEAD value with the marketplace-pinned SHA.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC