Plugin4Shell zero-click RCE hits AI coding agents; Claude-built exploit chain reached OpenAI internal repos

Air Security disclosed Plugin4Shell, a zero-click RCE bypassing SHA-pinned plugin updates in Claude Code, OpenAI Codex, GitHub/Microsoft Copilot, and Gemini CLI — Claude Code 2.1.179 and Codex 0.146.0 are patched; Copilot and Gemini CLI are not. Separately,…

Air Security researchers (named by GBHackers as Or Nevo, Dor Granat, and Niv Hoffman) disclosed Plugin4Shell, found in May 2026 with a working test attack reported in June 2026. The four major AI coding agents — Anthropic Claude Code, OpenAI Codex, GitHub/Microsoft Copilot, and Google Gemini CLI — fetch the plugin commit pinned by a marketplace but never verify the checked-out working tree matches the pinned 40-character SHA, so an attacker controlling the plugin repo can make checkout resolve to malicious code via a branch named after the pinned hash (works on Bitbucket-hosted and self-hosted git servers; GitHub blocks such names, a mitigation Air disputes as insufficient), with a separate Gemini CLI variant abusing a main branch named FETCH_HEAD. Background plugin auto-updates in Claude Code and Codex make the swap zero-click, and compromised plugins execute with developer permissions over source code, cloud credentials, SSH keys, and CI/CD. Anthropic patched Claude Code 2.1.179 and OpenAI patched Codex 0.146.0 after the June reports; Microsoft had shipped no Copilot fix at disclosure, and Google deprecated Gemini CLI without patching, directing users to Antigravity. The Hacker News reports no CVE has been assigned, no vendor advisories exist, and no real-world exploitation has been observed. Air's supporting SkillJacking research showed 925 hijacked skills reaching 134,000 agents, and an earlier Air test plugin spread to more than 26,000 agents before being pulled; GBHackers suggests an endpoint-side check that git rev-parse HEAD equals the pinned SHA. In a separate disclosure, Hacktron researchers reported that on July 25, 2026 they chained a heap buffer overflow in libheif 1.19.7 (1.19.8 also reported affected) — an out-of-bounds read/write during HEIC decoding, stemming from missing Debian security backports of an upstream fix that landed about a year earlier without being treated as a security issue — into remote code execution on community.openai.com, reached through Discourse HEIC/HEIF image uploads processed by ImageMagick that bypassed FastImage checks. Sources conflict on CVE status: Cyber Security News lists CVE-2026-32882 (DSA-6417-1), while Hacktron's writeup and SecurityWeek say the bug was never assigned a CVE. Claude Opus 5, released July 24, 2026 (the day before), built a working ARM64 exploit in about three hours after Claude Opus 4.8 failed under ASLR, then ported it to x86-64; the models also located the missing Debian backport. A…

• Plugin4Shell (Air Security; researchers Or Nevo, Dor Granat, Niv Hoffman) affects Claude Code, OpenAI Codex, GitHub/Microsoft Copilot, and Gemini CLI: agents check out marketplace-pinned plugin commits without verifying the working tree…
• Attack paths: a branch named after the pinned hash redirects checkout to malicious code on Bitbucket and self-hosted git servers (GitHub blocks such names, but Air disputes its SHA-naming mitigation as insufficient); Gemini CLI has a…
• Background plugin auto-updates in Claude Code and Codex make the attack zero-click; compromised plugins execute with developer permissions over source code, cloud credentials, SSH keys, and CI/CD.
• Plugin4Shell was found in May 2026 and reported to vendors in June 2026; per The Hacker News, no CVE has been assigned, no vendor advisories exist, and no real-world exploitation has been observed.
• Patches: Anthropic fixed Claude Code 2.1.179 and OpenAI fixed Codex 0.146.0; Microsoft Copilot was unpatched at disclosure; Google deprecated Gemini CLI without a fix and directs users to Antigravity.
• Suggested Plugin4Shell mitigation (GBHackers): an endpoint-side check that git rev-parse HEAD equals the pinned SHA.
• Air's SkillJacking research showed 925 hijacked skills reaching 134,000 agents; an earlier Air test plugin spread to more than 26,000 agents before being pulled.
• On July 25, 2026, Hacktron chained a libheif 1.19.7 (1.19.8 also reported affected) heap buffer overflow — out-of-bounds read/write during HEIC decoding — reached via Discourse HEIC/HEIF uploads processed by ImageMagick and bypassing…