Plugin4Shell: A Zero-Click RCE in Claude Code, Codex, Copilot and Gemini CLI

Plugin marketplaces for AI coding agents rely on a simple trust mechanism: a plugin is pinned to a specific, reviewed git commit hash (SHA), so once it passes review it cannot silently change. Researchers at Air Security found that four of the most widely used agents — Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI — checked that the *right* commit was requested, but never verified that the checkout actually *landed* there. They named the flaw Plugin4Shell.

How the bypass works

In Claude Code, Codex and Copilot, an attacker creates a git branch whose name is identical to the 40-character pinned commit hash. During git checkout, git prefers a matching ref name over the raw commit object, so the agent checks out the attacker's branch while still reporting success against the expected SHA. Gemini CLI had a variant of the same class of bug: checking out FETCH_HEAD after a fetch could resolve to the repository's default branch instead of the commit actually fetched, discarding the pinned version entirely.

Because a plugin runs with the same permissions as the developer using the agent, a swapped payload reaches their local files, stored credentials, and any cloud system they're authenticated into — full remote code execution, not just a sandboxed script.

Zero-click, by design

The detail that makes this more than a theoretical supply-chain risk is auto-update. Claude Code and Codex refresh installed plugins in the background by default, so the malicious checkout can happen on a routine update cycle — no new install, no approval prompt, no user action at all. A plugin only needs to look legitimate long enough to pass initial review, or an existing, trusted plugin repository needs to be compromised after the fact.

Patch status: two fixed, two exposed

• Claude Code — patched by Anthropic in version 2.1.179.
• OpenAI Codex — patched by OpenAI in version 0.146.0.
• GitHub Copilot — Microsoft has not shipped a fix as of publication.
• Gemini CLI — Google is not patching it; the tool is being retired, with users pointed toward Antigravity, which the report notes has no plugin-pinning mechanism for this bug to bypass.

Why it matters beyond these four tools

Plugin4Shell is being described as one of the first supply-chain vulnerabilities native to the AI-agent ecosystem rather than to a language's package registry. The underlying failure — verifying *what was requested* instead of *what actually landed on disk* — is a pattern worth auditing anywhere your organization treats a pinned hash, a signed manifest, or a locked dependency as sufficient proof of integrity. If your teams have granted coding agents broad local or cloud credentials to move faster, this is a reminder that the agent's trust boundary is now part of your attack surface.

What to check now

1. 1Confirm which coding agents are in use across your engineering org, including ones adopted informally by individual developers.
2. 2Update Claude Code to 2.1.179+ and Codex to 0.146.0+ immediately; for Copilot and Gemini CLI, treat installed plugins as unverified until a fix ships and restrict or remove unnecessary ones.
3. 3Review what credentials and cloud access your coding agents actually run with — scope them down rather than assuming plugin pinning was sufficient protection.