Plugin4Shell: Zero-Click RCE via SHA-Pin Bypass Hits Claude Code, Codex, Copilot, and Gemini CLI; Two Remain Unfixed

AIR (Air Security) researchers disclosed Plugin4Shell, a zero-click RCE that defeats SHA-pinned plugin updates in Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI; Claude Code 2.1.179 and Codex 0.146.0 are patched, while Copilot is unpatched and…

Researchers Or Nevo, Dor Granat, and Niv Hoffman at AIR (Air Security) disclosed Plugin4Shell, discovered in May 2026 and reported to vendors in June 2026 after a working test attack. All four major AI coding agents — Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI — fetch SHA-pinned plugin commits without verifying that the checked-out working tree actually matches the pinned commit hash. An attacker who controls a plugin repository can create a branch whose name resembles the 40-character hex commit hash (or, in the Gemini CLI variant, a main branch named FETCH_HEAD) so the checkout resolves to malicious code while the pin appears intact. Hash-shaped branch names work on hosts like Bitbucket and self-hosted Git servers; GitHub blocks such names, though its rules do not clearly block the FETCH_HEAD naming. Because Claude Code and Codex auto-update plugins in the background, the swap is zero-click, requiring no user interaction. Threat paths include backdooring a legitimate plugin or hijacking a trusted maintainer repository, as demonstrated by AIR's SkillJacking research, in which 925 hijacked skills reached 134,000 agents; an earlier AIR test plugin spread to more than 26,000 agents before being pulled. Compromised plugins run with developer-level privileges, exposing source code, API keys, cloud credentials, SSH keys, secrets, and CI/CD systems. Anthropic fixed Claude Code in version 2.1.179 and OpenAI fixed Codex in 0.146.0; Microsoft had shipped no Copilot fix at disclosure, and Google will not patch the deprecated Gemini CLI, directing users to Antigravity. A suggested mitigation is an endpoint-side check that git rev-parse HEAD equals the pinned SHA. No CVE has been assigned, no vendor advisories exist, and no real-world exploitation has been observed.

• Vulnerability named Plugin4Shell; no CVE assigned, no vendor advisories, and no observed real-world exploitation as of disclosure
• Affected agents: Anthropic Claude Code, OpenAI Codex, GitHub Copilot, and Google Gemini CLI
• Root cause: agents check out SHA-pinned plugin commits without verifying the working tree landed on the pinned commit; a branch named like the 40-character commit hash (or FETCH_HEAD in Gemini CLI) resolves to attacker-controlled code
• Attack works on Bitbucket and self-hosted Git servers; GitHub blocks hash-shaped branch names, but its rules do not clearly block a main branch named FETCH_HEAD
• Zero-click execution via background plugin auto-updates in Claude Code and Codex; no user interaction required
• Patched: Claude Code 2.1.179 (Anthropic) and Codex 0.146.0 (OpenAI); GitHub Copilot unpatched at disclosure; Gemini CLI deprecated without a fix, with Google pointing users to Antigravity
• Impact: swapped plugins run with developer permissions, exposing source code, API keys, cloud credentials, SSH keys, secrets, and CI/CD systems
• Researchers: Or Nevo, Dor Granat, and Niv Hoffman of AIR (Air Security); discovered May 2026, working test attack reported June 2026, public disclosure 2026-09-18