Plugin4Shell: A Zero-Click Flaw Threatens Every Major AI Coding Agent

AI coding agents inherit the security models of the plugin ecosystems they trust. Researchers at Air discovered that inheritance is broken: a zero-click remote code execution vulnerability dubbed Plugin4Shell affects major agents including Claude Code, OpenAI Codex, Gemini CLI, Microsoft Copilot, and GitHub Copilot.

The attack does not target model weights or prompt injection alone. It strikes plugin marketplaces — the curated repositories where agents download extensions — and bypasses SHA-pinning mechanisms designed to verify code integrity.

Attack mechanics

Agents use SHA-pinning to ensure plugins match expected hashes before execution. Plugin4Shell allows an attacker who controls a plugin repository — or poisons a marketplace entry — to hijack that verification path and deliver malicious payloads without user interaction. Zero-click means the developer does not need to approve a suspicious prompt; installing or updating a trusted-looking plugin is enough.

Supply chain attacks against developer tools have precedent — npm compromises, VS Code extension malware, compromised CI templates. Plugin4Shell scales the blast radius because AI agents often run with broad filesystem and network permissions to be useful.

Vendor responses diverge

Patching status as of September 18, 2026:

• Anthropic patched Claude Code in version 2.1.179 after Air's disclosure
• OpenAI patched Codex in version 0.146.0
• Google deprecated Gemini CLI entirely, declined to patch, and directed users to Antigravity — a newer agentic environment claimed immune to this vector
• Microsoft did not respond to Air's June disclosure according to researchers; Copilot may remain exposed via marketplaces hosted on non-GitHub platforms like Bitbucket

Air disputed Google's claim that Antigravity eliminates risk, noting marketplaces can live on multiple hosting platforms Microsoft Copilot also supports.

Defensive measures for teams

Pin plugin sources aggressively. Allowlist marketplaces and authors; block auto-update for agent plugins in production engineering environments.

Run agents in sandboxes. Separate developer workstations from production credentials; assume agent compromise is plausible.

Audit SHA-pinning implementations if you build internal agent tooling — Plugin4Shell is a class vulnerability, not a one-off bug.

Track vendor patch levels across Claude Code, Codex, Copilot, and any Gemini CLI stragglers still installed.

Treat agent permissions like production service accounts. Least privilege, rotation, and logging — agents are executors, not magic boxes.

The bottom line

Plugin4Shell is a reminder that AI security is software supply chain security. The flashy risks — jailbreaks, misalignment, model theft — dominate headlines. The mundane risks — compromised plugins, stale CLIs, unpatched marketplaces — are what attackers actually use. Patch Claude Code and Codex; migrate off Gemini CLI; pressure Microsoft for clarity on Copilot. Your agent is only as secure as the plugins it trusts.