Plugin4Shell: The Zero-Click Bug Hiding in Your AI Coding Agent's Plugins
A flaw called Plugin4Shell lets a malicious plugin update run code on your machine with no click and no approval. Claude Code and Codex are patched. Copilot and Gemini CLI are not.
Security researchers at Air Security disclosed a vulnerability called Plugin4Shell on September 17. It affects the plugin systems in Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI, the four most widely used AI coding agents. A malicious plugin update can run code on a developer's machine the moment the agent installs or refreshes it. No click, no approval prompt, no reinstall needed.
Air Security is calling it the first real supply chain attack built specifically for the AI agent ecosystem. That framing matters because these agents don't run with limited permissions. They run with yours: your source code, your cloud credentials, your SSH keys, your access to internal repos and production systems.
How the trick works
Coding agents let developers install plugins from community marketplaces, then pin them to a specific Git commit hash so future updates can't silently swap in different code. That pin is supposed to be the safety net.
The bug is that the agents check the hash but don't actually verify that the code checked out onto disk matches it. For Claude Code, Codex, and GitHub Copilot, an attacker can push a branch whose name is identical to the 40-character commit hash the plugin is pinned to. Git will sometimes resolve that branch name ahead of the actual commit object during checkout, so the agent installs the attacker's branch while still reporting that the expected hash was verified.
Gemini CLI has its own version of the same idea. Its plugin installer fetches the pinned commit, then checks out a reference called FETCH_HEAD. An attacker who controls a branch literally named FETCH_HEAD can get that branch checked out instead of the commit that was actually fetched.
Either way, the developer sees a normal, successful plugin install. There's nothing to click past and nothing that looks wrong.
Who's actually exposed right now
The researchers privately reported this to all four vendors in June, giving them roughly three months before going public. The response since then has split badly:
Anthropic patched the issue in Claude Code 2.1.179. OpenAI patched it in Codex 0.146.0. GitHub says it has a mitigation in place, but the researchers dispute how complete it is: GitHub's fix covers plugins hosted directly on GitHub, but Copilot remains exposed when a plugin's source is Bitbucket or a self-hosted Git server. Google's response was to say Gemini CLI is deprecated, won't be patched, and that users should migrate to Antigravity instead.
That means two of the four most-used AI coding agents on the market are still exploitable through this exact path today.
What to actually check
If your team uses any of these tools, this is worth five minutes right now:
Update Claude Code to 2.1.179 or later, and Codex to 0.146.0 or later, if you haven't already pulled the latest release.
If you use GitHub Copilot with plugins, check where those plugins are actually hosted. One sourced from GitHub itself is covered by GitHub's mitigation. One sourced from Bitbucket or a self-hosted server is not.
If you're still running Gemini CLI, treat it as permanently unpatched. Either migrate to Antigravity or stop installing third-party plugins through it entirely.
More broadly, it's worth listing every plugin your team's agents have installed and asking what that plugin can actually reach if it turns hostile. Most teams have never audited this, because until a few days ago there was no reason to think about it.
Why this matters beyond the four tools named
Plugin4Shell is a reminder that the attack surface of AI-assisted development isn't just the code the model writes. It's the tooling itself, and the trust assumptions baked into how that tooling installs and updates things. A pinned commit hash felt like a strong guarantee until someone found the one place it wasn't actually being checked.
This is the same category of gap we see constantly when we audit apps that were built quickly with AI tools: a control that looks like it's there, but was never actually verified end to end. If you want a second set of eyes on whether your own application has similar gaps, whether in a login flow, an API route, or a payment handler, you can run a free assessment and get a plain-language breakdown of what to fix first.
VibeAudits audits apps built with Cursor, Lovable, Bolt, Claude Code, Replit, and other AI tools.