Plugin4Shell flaw enables zero-click code execution in four AI coding agents
Summary
AIR reports Plugin4Shell, a zero-click RCE in four AI coding agents that lets attackers bypass plugin SHA pinning. Anthropic and OpenAI patched; Microsoft has not, and Google deprecated Gemini CLI.
Key points
- AIR says Plugin4Shell affects Claude Code, Codex, GitHub Copilot, and Gemini CLI through weaknesses in plugin SHA-pinning checks.
- The agents check out pinned commits without verifying that the checkout landed on the pinned commit, allowing malicious plugin code to replace reviewed code.
- The vulnerability can be exploited through a malicious plugin that turns harmful later or by taking over a trusted plugin repository.
- Background auto-updates can rerun the vulnerable checkout and deliver malicious code to already-installed plugins without user action.
- AIR reported proof-of-concept exploits for all four agents and disclosed the issue to vendors in June 2026.
- Anthropic patched Claude Code in version 2.1.179 and OpenAI patched Codex in version 0.146.0; Microsoft had not shipped a Copilot fix at publication.
- Google deprecated Gemini CLI rather than patching it and advised users to move to Antigravity.
Article Details
- Vulnerability Types
- Plugin SHA-pinning bypass enabling zero-click remote code execution
- Severity
- Zero-click RCE
- Affected Versions
- Claude Code versions before 2.1.179
- Codex versions before 0.146.0
- GitHub Copilot: no fixed version reported
- Gemini CLI: all existing installs remain exposed
- Exploitation Status
- unknown
- Exploit Availability
- public_poc
- Patch Status
- partial
- Workarounds
- Gemini CLI users are advised by Google to move to Antigravity.
MITRE ATT&CK
T1059 · Command and Scripting InterpreterThe SHA-pinning bypass permits malicious plugin code to run through an affected coding agent, resulting in zero-click remote code execution.T1195.001 · Compromise Software Dependencies and Development ToolsAn attacker can publish a plugin that passes review and later swap in malicious code, or take over a trusted plugin repository to distribute it to installed agents.
Vendors
Products
Antigravity#Plugin4ShellClaude CodeAIR uncovered Plugin4Shell, a zero-click RCE affecting Claude Code, Codex, GitHub Copilot, and Gemini CLI through a shared plugin SHA-pinning bypass.CodexAIR uncovered Plugin4Shell, a zero-click RCE affecting Claude Code, Codex, GitHub Copilot, and Gemini CLI through a shared plugin SHA-pinning bypass.Gemini CLIAIR uncovered Plugin4Shell, a zero-click RCE affecting Claude Code, Codex, GitHub Copilot, and Gemini CLI through a shared plugin SHA-pinning bypass.GitHub CopilotAIR uncovered Plugin4Shell, a zero-click RCE affecting Claude Code, Codex, GitHub Copilot, and Gemini CLI through a shared plugin SHA-pinning bypass.