Plugin4Shell Zero-Click RCE Hits Claude Code, Codex, Copilot and Gemini CLI
Researchers disclosed Plugin4Shell, a zero-click RCE in AI coding agents' Git SHA-pinned plugin updates, affecting Claude Code, Codex, Copilot, and Gemini CLI.
Air Security researchers found that Claude Code, Codex, and GitHub Copilot do not verify that a checked-out plugin working tree matches the marketplace-pinned Git commit, letting attackers redirect checkout to a malicious branch named like the 40-character hash. Gemini CLI has a separate variant abusing a FETCH_HEAD branch. Because Claude Code and Codex auto-update plugins in the background, a plugin can be hijacked after gaining adoption with no user interaction. Anthropic fixed Claude Code 2.1.179 and OpenAI patched Codex 0.146.0; Gemini CLI is deprecated without a fix and Microsoft Copilot was unpatched at disclosure.
- Git reference resolution lets a branch named after the pinned commit hash deliver malicious code
- Automatic background plugin updates make the attack zero-click; hijacking a maintainer repo works too
- Compromised agents inherit developer permissions: source code, cloud credentials, SSH keys, CI/CD
- Claude Code 2.1.179 and Codex 0.146.0 patched; Copilot fix outstanding at disclosure
- ATT&CK
- T1195.001 Compromise Software Dependencies and Development ToolsT1195.002 Compromise Software Supply Chain
- Organizations
- Air Security
From the original article
3 min read at cybersecuritynews.com
Plugin4Shell is a high-severity, zero-click remote code execution vulnerability affecting major AI coding agents, including Anthropic Claude Code, OpenAI Codex, GitHub Copilot, and Google Gemini CLI. The flaw allows a malicious plugin update to execute attacker-controlled code without requiring a user to click, approve, or reinstall anything. Plugin4Shell targets the software supply chain behind AI […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.