Plugin4Shell – Zero Click RCE Vulnerability found in top four coding agents

Recorded: Sept. 18, 2026, 1 a.m.

Original

Summarized

Plugin4Shell - Zero Click RCE Vulnerability found in top 4 most popular coding agents, millions of agents affected

We're out of stealth!Read the AIR story

Main menuProductScannersScannersScan your add-onsScan your agentEarly AccessResearch1EventsSecTor 26Case opened

BlackHat 26Circus of skillsMerch shopScannersScan your add-onsScan your AgentEarly AccessEventsSecTor 26Case opened

BlackHat 26Circus of skillsMerch shopBook a DemoBook a Demo

AIR is on its way.We'll contact you shortly to set up your demo.Take a Peek While You WaitBook a demoExperience AIR firsthand
SubmitBackPlugin4Shell - Zero Click RCE Vulnerability found in top 4 most popular coding agents, millions of agents affectedPlugin4Shell is a zero-click, high-severity RCE affecting all four major AI coding agents - Claude Code, Codex, Copilot, and Gemini. In this first-of-its-kind AI supply-chain attack, a trusted plugin is silently swapped for a malicious one and auto-installed past the agent's SHA pinning - a flaw no marketplace can fix, so users must update their agent.Or Nevo,Dor Granat,Niv HoffmanSeptember 17, 2026ShareCopied to ClipboardAgent add-ons - the plugins and skills you install into an AI agent - are effectively applications, and enterprises overwhelmingly install them from open community marketplaces rather than a vetted, enterprise-grade one. The agent runs with the full capabilities of the employee operating it: the same access to sensitive data, internal systems, and production environments. Plugins inherit those permissions by default. A malicious plugin therefore does not need to escalate anything: it achieves full remote code execution on the employee's machine and hands an attacker the same reach over the enterprise's crown jewels that the employee has.The story so farThis is the third act of a story we have been telling. In The Story of Skills we showed how easy it is to get in: we built a malicious skill, watched it go viral, and seized control of over 26,000 agents - planting your code in a marketplace people trust is not the hard part. In SkillJacking we showed you don't even need to plant anything: 925 skills already in use were hijacked out from under their maintainers, affecting 134,000 agents, by taking over the repositories behind them. The industry's answer to exactly this kind of rug-pull is SHA pinning - review the code at one commit, pin that commit, and trust that the pinned commit is what runs forever after. Plugin4Shell is the story of that boundary failing.It is a plugin SHA-pinning bypass: the agent checks out the exact commit the marketplace pinned but never verifies it landed there, so an attacker who controls the plugin's repo makes the checkout resolve to malicious code while the pin still looks honored. The result is zero-click remote code execution across Claude Code, Codex, GitHub Copilot, and Gemini CLI.Enterprises using Air Marketplace and Air Filter were not affected by Plugin4Shell.Why Plugin4Shell is uniqueIt is the first supply chain vulnerability of the AI agent ecosystem. Previous agent security work has targeted the model or the agent itself. Plugin4Shell attacks the distribution layer underneath them, the marketplaces through which agent add-ons reach millions of machines.Zero-click remote code execution. No user interaction of any kind is required. The result is full compromise of the agent and the host it runs on, and with it full access to every asset and every piece of data the agent can reach.One flaw, and every major lab made it. The same design error sits in every affected agent - not an implementation slip in one product, but a single mistake repeated across the industry, leaving millions of agents vulnerable.A marketplace cannot fully close this. The pin is resolved inside the agent, so only an agent-side fix restores the guarantee. A marketplace can blunt the branch-name variant by allowing only hosts that reject SHA-shaped names - effectively, GitHub-only - but that bans hosts the agents officially support, and does nothing for Gemini CLI's variant.Who is affected and what is the impactAnyone running a major coding agent that installs plugins from a marketplace is exposed. That is Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI. The exposure is not limited to users who install plugins carelessly: the victim only has to have a plugin installed, from a marketplace they trust, that was reviewed and pinned exactly as the security model intends.Doing the right thing does not protect you. Organizations that go beyond a community marketplace - reviewing plugins and pinning them to a reviewed commit - rely on SHA pinning as their safeguard, and Plugin4Shell quietly nullifies it: review passes, the pin is written, and different code installs. Every downstream vetting process built on pinning inherits the failure.What makes it 0-click is plugin auto-update. Agents update installed plugins in the background - in Claude Code and Codex this is the default - so when the pinned commit is swapped upstream, a plugin the user already trusts and already has installed is replaced with a malicious version without any user interaction: no install step, no prompt, nothing to notice. The attacker does not need to persuade anyone to install anything new. They only need the benign plugin to already be there.How it can be exploitedThere are two paths, and neither requires the attacker to control the marketplace.Method 1: publish a plugin, then turn it malicious. The attacker contributes a genuinely benign plugin to a trusted marketplace, passes review, and later swaps its content for a malicious version. Getting a plugin into a top marketplace is not hypothetical - we've already done it (The Story of Skills).Method 2: hijack a legitimate author's plugin. The attacker takes over the repository behind a plugin someone else wrote and the marketplace already trusts, then exploits Plugin4Shell to force the malicious version onto every agent that has it installed - bypassing the version pinning that exists precisely to stop this. We demonstrated the takeover step in the wild in SkillJacking and RepoJacking. Together, the chain is proven end to end - takeovers happen at scale, and Plugin4Shell defeats the mechanism built to contain them.The attack, end to end:

1
Plant
The attacker publishes a genuinely benign plugin, pinned at commit aaa...aaa. It passes review.

2
Adoption
People install it. Every install is pinned to aaa...aaa, the reviewed, trusted version.

3
Version bump
The attacker ships a routine update: the marketplace re-pins to a new, still-benign commit bbb...bbb. The pin has changed.

4
Rug-pull
The attacker creates a branch named bbb...bbb, sets it as the repo's default, and points it at malicious code. The pinned commit itself can stay untouched.

5
Auto-update to RCE
The changed pin triggers every agent's background auto-update. The checkout resolves bbb...bbb to the branch - git prefers a ref over a commit of the same name - and it runs. No prompt, no click.

Technical deep diveEvery affected agent checks out the pinned commit but never checks that it actually landed there. That one missing check is the whole bug - and git gives an attacker two ways to exploit it.The pinned commit becomes a branch - Claude Code, Codex, GitHub CopilotThese agents clone the plugin repository and check out the pinned SHA:git clone <plugin repo> ./git checkout aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaThe attacker, who now controls the upstream repository, creates a branch whose name is the exact 40-hex pinned SHA and makes it the repository's default, so the plain git clone above brings it down as a local branch of that name. git checkout then resolves the pinned SHA to that branch: when a name is both a valid ref and an object id, git prefers the ref and only prints a refname is ambiguous warning - so it never matters whether the pinned commit is still present, the branch is what gets checked out. Two conditions make it work: nothing blocks a branch from being named like a hash (git's own git check-ref-format accepts 40-hex names, and hosts that follow the protocol accept them too), and the branch must be the repository's default - a non-default branch is fetched only as a remote-tracking ref, and the checkout would fall back to the commit. The working tree is now attacker-controlled, and the agent reports a successful install at the pinned commit.This is not only an install-time bug, and that is what makes it zero-click: the same git checkout re-runs on background auto-update - the default in Claude Code and Codex - so when the marketplace bumps the pinned SHA, the swap reaches already-installed plugins with no user action.This only works where a branch can be named like a hash. That is git's default behavior, but some hosts forbid it - GitHub rejects a 40-hex branch name outright - while others, Bitbucket among them, and any self-hosted git server, allow it. Marketplaces on those hosts are a supported configuration; Anthropic's own documentation lists Bitbucket and self-hosted git as valid marketplace backends.The pin is fetched but never checked out - Gemini CLIGemini pins with --ref and installs in three steps:git clone --depth 1 <plugin repo> ./git fetch origin 41d0bc0a4aeb2fbf797dacea39e876d98c95024bgit checkout FETCH_HEADThe fetch retrieves the correct commit and records it in .git/FETCH_HEAD. But git checkout FETCH_HEAD does not have to read that file: if the repository's default branch is itself named FETCH_HEAD, the checkout resolves to the branch, and the fetched commit is silently discarded in favor of attacker-controlled default-branch content.One assertion closes both variants: after checkout, resolve the commit actually in the working tree and abort unless it equals the pinned SHA.test "$(git rev-parse HEAD)" = "<pinned-sha>" || abortIt has to check the resolved HEAD, not the ref that was requested - that distinction is exactly what the Gemini variant slips through. And it has to run inside the agent: the pin is resolved on the client, so no marketplace can enforce the guarantee it advertises.How it can be mitigatedBecause the pin is resolved inside the agent, no marketplace can enforce it - the fix has to ship in the agent, and updating is the only complete mitigation where one exists:Claude Code - Anthropic patched it after our disclosure, in 2.1.179.Codex - OpenAI patched it after our disclosure, in 0.146.0.GitHub Copilot - we disclosed the same flaw to Microsoft, which has not shipped a fix, so users have no patch.Gemini CLI - Google has deprecated the Gemini CLI and will not patch it, so every install stays vulnerable for good; those users should migrate to Antigravity, which this attack does not reach - it has no marketplace plugin SHA pinning to bypass.Timeline

When
What

May 2026
Found by the Air Security research lab, with a working PoC against all four agents

June 2026
Disclosed to all four vendors under coordinated disclosure

2026-06-17
Anthropic confirms the fix in Claude Code 2.1.179

2026-08-04
Google confirms no fix will ship, as the Gemini CLI is deprecated. Users are advised to migrate to Antigravity

2026-08-12
Codex 0.146.0 verified fixed

Enterprises using Air Marketplace and Air Filter were not affected by Plugin4Shell. Book a demo to learn more about how can Air protect from agentic supply chain vulnerabilities.Book a DemoTable of ContentsIntroLink textLink text
Read next...AIR is Coming Out of StealthToday, with enormous excitement, we're announcing that AIR is coming out of stealth. 2026 is the year enterprises went all-in on coding agents. It's also the year they realized they were deploying them without a seatbelt. AIR builds that seatbelt: a firewall for the context AI agents operate in.Yair SabanSeptember 1, 2026This is some text inside of a div block.AIR is Coming Out of StealthToday, with enormous excitement, we're announcing that AIR is coming out of stealth. 2026 is the year enterprises went all-in on coding agents. It's also the year they realized they were deploying them without a seatbelt. AIR builds that seatbelt: a firewall for the context AI agents operate in.Yair SabanSeptember 1, 2026September 1, 2026Today, with enormous excitement, we're announcing that AIR is coming out of stealth. 2026 is the year enterprises went all-in on coding agents. It's also the year they realized they were deploying them without a seatbelt. AIR builds that seatbelt: a firewall for the context AI agents operate in.MCPJacking: 155 Hijackable MCPs Discovered Live in the Official MCP Marketplace We discovered 155 hijackable MCPs in the official worldwide marketplace used by millions of agents. Each relied on an expired domain, so we simply registered them, published our own MCPs and gained full remote prompt execution on every agent that trusted them. Even official marketplaces carry this supply chain risk, and any enterprise using MCPs is exposed. Enterprises on Air Marketplace are not exposed to MCPjacking.Nadav Dadush,Eliad Mualem,Roi SnirAugust 27, 2026This is some text inside of a div block.MCPJacking: 155 Hijackable MCPs Discovered Live in the Official MCP Marketplace We discovered 155 hijackable MCPs in the official worldwide marketplace used by millions of agents. Each relied on an expired domain, so we simply registered them, published our own MCPs and gained full remote prompt execution on every agent that trusted them. Even official marketplaces carry this supply chain risk, and any enterprise using MCPs is exposed. Enterprises on Air Marketplace are not exposed to MCPjacking.Nadav Dadush,Eliad Mualem,Roi SnirAugust 27, 2026August 27, 2026We discovered 155 hijackable MCPs in the official worldwide marketplace used by millions of agents. Each relied on an expired domain, so we simply registered them, published our own MCPs and gained full remote prompt execution on every agent that trusted them. Even official marketplaces carry this supply chain risk, and any enterprise using MCPs is exposed. Enterprises on Air Marketplace are not exposed to MCPjacking.AIR and AWS MarketplaceWe're excited to share that AIR is now listed as "Deployed on AWS" in AWS Marketplace, reflecting our ongoing partnership with AWS.Niv HoffmanAugust 19, 2026This is some text inside of a div block.AIR and AWS MarketplaceWe're excited to share that AIR is now listed as "Deployed on AWS" in AWS Marketplace, reflecting our ongoing partnership with AWS.Niv HoffmanAugust 19, 2026August 19, 2026We're excited to share that AIR is now listed as "Deployed on AWS" in AWS Marketplace, reflecting our ongoing partnership with AWS.AIR Is Now Available on Google Cloud MarketplaceGoogle Cloud customers can now procure AIR through their existing Google Cloud account, with consolidated billing and the ability to draw down on existing Google Cloud committed spend.Niv HoffmanSeptember 3, 2026AIR Is Now Available on Google Cloud MarketplaceGoogle Cloud customers can now procure AIR through their existing Google Cloud account, with consolidated billing and the ability to draw down on existing Google Cloud committed spend.Niv HoffmanSeptember 3, 2026September 3, 2026Google Cloud customers can now procure AIR through their existing Google Cloud account, with consolidated billing and the ability to draw down on existing Google Cloud committed spend.AIR is Coming Out of StealthToday, with enormous excitement, we're announcing that AIR is coming out of stealth. 2026 is the year enterprises went all-in on coding agents. It's also the year they realized they were deploying them without a seatbelt. AIR builds that seatbelt: a firewall for the context AI agents operate in.Yair SabanSeptember 1, 2026AIR is Coming Out of StealthToday, with enormous excitement, we're announcing that AIR is coming out of stealth. 2026 is the year enterprises went all-in on coding agents. It's also the year they realized they were deploying them without a seatbelt. AIR builds that seatbelt: a firewall for the context AI agents operate in.Yair SabanSeptember 1, 2026September 1, 2026Today, with enormous excitement, we're announcing that AIR is coming out of stealth. 2026 is the year enterprises went all-in on coding agents. It's also the year they realized they were deploying them without a seatbelt. AIR builds that seatbelt: a firewall for the context AI agents operate in.MCPJacking: 155 Hijackable MCPs Discovered Live in the Official MCP Marketplace We discovered 155 hijackable MCPs in the official worldwide marketplace used by millions of agents. Each relied on an expired domain, so we simply registered them, published our own MCPs and gained full remote prompt execution on every agent that trusted them. Even official marketplaces carry this supply chain risk, and any enterprise using MCPs is exposed. Enterprises on Air Marketplace are not exposed to MCPjacking.Nadav DadushAugust 27, 2026MCPJacking: 155 Hijackable MCPs Discovered Live in the Official MCP Marketplace We discovered 155 hijackable MCPs in the official worldwide marketplace used by millions of agents. Each relied on an expired domain, so we simply registered them, published our own MCPs and gained full remote prompt execution on every agent that trusted them. Even official marketplaces carry this supply chain risk, and any enterprise using MCPs is exposed. Enterprises on Air Marketplace are not exposed to MCPjacking.Nadav Dadush,Eliad Mualem,Eliad MualemAugust 27, 2026August 27, 2026We discovered 155 hijackable MCPs in the official worldwide marketplace used by millions of agents. Each relied on an expired domain, so we simply registered them, published our own MCPs and gained full remote prompt execution on every agent that trusted them. Even official marketplaces carry this supply chain risk, and any enterprise using MCPs is exposed. Enterprises on Air Marketplace are not exposed to MCPjacking.

MainProductResearchBook a demoScannersScan your add-onsScan your agentEventsCircus of skillsMerch shopCertifications

Plugin4Shell is a zero-click, high-severity Remote Code Execution vulnerability affecting the four major AI coding agents: Claude Code, Codex, GitHub Copilot, and Gemini CLI. This represents a novel supply chain attack targeting the distribution layer of the AI agent ecosystem, where trusted plugins and skills are installed from open community marketplaces. The vulnerability stems from a flaw in the mechanism designed to ensure the integrity of installed components, specifically the SHA pinning system. This system is intended to ensure that code installed via a recognized marketplace remains exactly as specified, but Plugin4Shell exploits a failure in this verification process, allowing a malicious plugin to be silently swapped into the agent.

The core issue lies in the discrepancy between the promise of SHA pinning and the actual behavior of agent systems. While the security model dictates that the agent should verify that the plugin installed matches the pinned commit hash, the agents fail to check if the committed code actually resides at the pinned location. This oversight allows an attacker who controls a plugin repository to manipulate the installation process. This operation is zero-click because the exploitation occurs during the agent's background, automatic update process, meaning no user interaction or explicit install command is needed for the compromise to occur. The malicious plugin can achieve full remote code execution on the employee's machine and grant the attacker access to all assets that the agent possesses, effectively bypassing standard security controls.

The attack can be executed via two primary methods, neither requiring control over the marketplace itself. The first method involves the attacker publishing a genuinely benign plugin to a trusted marketplace, which passes review. Subsequently, the attacker replaces the content of that plugin with malicious code. The second method involves hijacking the repository of a legitimate author whose plugin the marketplace trusts, thereby exploiting Plugin4Shell to force the malicious version onto every affected agent by overriding version pinning. The attack sequence demonstrates that a routine version bump in the marketplace can be leveraged to trigger the agent’s auto-update, during which the checkout resolves to a malicious branch that the attacker controls, resulting in remote code execution.

Technically, the exploit leverages specific behaviors in git functionality. For agents utilizing plugins where the pinned commit becomes a branch name, the agent's checkout process does not adequately verify the resolved commit against the original pinned SHA. This failure is particularly pronounced in implementations where the agent resolves the commit internally rather than strictly checking the final state. The vulnerability is compounded because the necessary protection is meant to reside within the agent itself, as external marketplaces cannot enforce the guarantee.

Mitigation strategies are necessarily agent-side. Because the discrepancy is resolved within the agent's operational environment, no marketplace can fix this vulnerability. The complete mitigation requires that the agent systems implement the necessary checks. Patches have been released for Claude Code and Codex, addressing this flaw after disclosure, but the situation for Gemini CLI is different, as Google has deprecated the Gemini CLI and will not issue a fix. Users of Gemini CLI are advised to migrate to alternative solutions, such as Antigravity, which this specific attack vector does not target due to its lack of marketplace plugin SHA pinning. Furthermore, broader industry efforts, such as the development of frameworks like AIR, aim to establish a necessary security firewall for context AI agents to address this class of agentic supply chain vulnerabilities. Related risks, such as MCPJacking, also highlight the pervasive supply chain exposures present in marketplace systems.