Plugin4Shell: zero-click RCE in four coding agents. Copilot unpatched

AIR Security says it found a zero-click vulnerability in the four major coding agents: Anthropic Claude Code, OpenAI Codex, GitHub Copilot and Google Gemini CLI. The bug is not in the model. It is in how the agent fetches plugins from marketplaces and pins them to a reviewed Git commit. The pin looks honest. The code that lands can be different.

The Register confirmed the research on 17 September. Help Net Security and InfoWorld followed on 18 September. Anthropic and OpenAI have patched. Google will not patch Gemini CLI. Microsoft had not shipped a Copilot fix when the research went public.

What was disclosed

Researchers Or Nevo, Dor Granat and Niv Hoffman at AIR call the flaw Plugin4Shell. They describe it as the first supply-chain vulnerability of the AI agent ecosystem: the attack hits the distribution layer underneath the agent, not the model itself.

The mechanism is simple, which is why it scales. Marketplaces pin plugins to a specific commit after review. The agent checks out that pinned commit but never verifies that the working tree actually matches it. If an attacker controls the plugin repository, checkout can resolve to other code while the pin still looks honoured. The result is remote code execution with no click, no approval and no reinstall.

What makes it zero-click is auto-update. In Claude Code and Codex, background plugin updates are the default. When the pinned commit is swapped upstream, a plugin the user already trusts is replaced. The victim does not need to install anything new. A reviewed plugin already present is enough.

AIR describes two paths, neither of which requires control of the marketplace. One is to submit a benign plugin, pass review, then swap the contents. The other is to take over the repository behind a plugin someone else already landed. The researchers point to earlier work planting skills and hijacking maintained repositories. Plugin4Shell, they say, is the control that was supposed to stop the rug-pull after the plugin is inside.

This does not only hit careless users. Organisations that do the “right” thing — review, pin, trusted marketplace — inherit the failure. Review passes. The pin is written. Different code installs.

Who patched, and who did not

AIR found the bug in May 2026, with a working proof against all four agents, and disclosed it to vendors in June.

Anthropic confirmed a fix in Claude Code 2.1.179 on 17 June. OpenAI Codex 0.146.0 was verified fixed on 12 August. Google said on 4 August that Gemini CLI is deprecated and will not be patched. Users are told to move to Antigravity, which AIR says does not have the same marketplace SHA-pinning to bypass. Every remaining Gemini CLI install stays exposed.

GitHub Copilot is the open flank. AIR says it disclosed to Microsoft in June and that no patch existed at publication. A GitHub spokesperson told The Register that GitHub blocks branch names that resemble commit SHAs, so the bug cannot be exploited on GitHub. AIR replies that this is not enough: agents also support marketplaces on other Git hosts, including Bitbucket and self-hosted Git, where such names are allowed. Anthropic’s own documentation lists those backends as valid. Microsoft did not respond to The Register.

The Register notes Microsoft’s own figure: about 90 percent of the Fortune 500 use Copilot. For any enterprise that already let coding agents into source, this is not a lab footnote.

AIR sells its own marketplace and filter products and says those customers were not affected. That is a vendor claim, not an independent test. The vulnerability itself is corroborated by multiple outlets, and the patch status is specific enough to manage against.

What it means for CIOs and CISOs

Coding agents are privileged. They read repos, run commands, hold cloud tokens and can open pull requests. A plugin with RCE is not an IDE nuisance. It is a foothold with the same reach as the developer running the agent.

Three decisions belong in this week’s risk meeting, not in next quarter’s AI programme.

First: inventory. Which coding agents run against production-adjacent repos? Which version? Which plugins, from which marketplaces, with auto-update on? Gemini CLI still sitting on developer machines should go, not “sunset later”. Claude Code below 2.1.179 and Codex below 0.146.0 should move up. Copilot without a fix should be treated as an open vulnerability: cut third-party plugins, disable auto-update where possible, and demand written status from Microsoft.

Second: stop treating pinning as a control. Pinning without verifying what actually landed on disk is theatre. Require the agent to abort if HEAD does not match the pin. Require marketplaces and internal mirrors to fetch only from hosts that reject SHA-shaped branch names, and apply the same block on self-hosted Git. Plugin review without that check is not control.

Third: vendor contract. Coding agents belong in the same track as privileged software: SBOM for plugins, notification deadlines, patch SLAs, logging of what the agent installs, and a ban on unknown marketplaces. If Copilot is still unpatched in your tenant, that is a board item, not a “known limitation”.

Banks, energy and public-sector teams that let agents into source have already moved the attack surface from the laptop to the supply chain. Plugin4Shell shows the industry copied the same missing check. That is not a single-product bug. It is a shared design choice.

Sources and media

Primary source: AIR Security, Or Nevo, Dor Granat and Niv Hoffman, “Plugin4Shell - Zero Click RCE Vulnerability found in top 4 most popular coding agents, millions of agents affected”, 17 September 2026. https://www.air.security/blog-posts/plugin4shell

Secondary: The Register, Jessica Lyons, “AI coding agents' 0-click RCE flaw could hand attackers keys to the kingdom”, 17 September 2026 22:42 UTC. https://www.theregister.com/security/2026/09/17/ai-coding-agents-0-click-rce-flaw-could-hand-attackers-keys-to-the-kingdom/5297335

Help Net Security, 18 September 2026. InfoWorld, 18 September 2026.

AIR is a security vendor that sells agent protection. Patch versions and the GitHub statement were cross-checked against The Register.

Thumbnail: OpenAI Image 2 / hogby.ai