AIR Discloses Plugin4Shell Zero-Click RCE in AI Coding Agents
TL;DR
- AIR found the flaw in May 2026, built working PoCs against all four agents, and disclosed to each vendor before publication.
- The bug lives in client-side Git reference resolution; no plugin marketplace can ship a fix unilaterally.
- Anthropic patched in Claude Code 2.1.179 and OpenAI in Codex 0.146.0; Microsoft and Google have not shipped a fix.
Plugin4Shell, disclosed by researchers at AIR and covered this week in Help Net Security, lets an attacker swap malicious code into a pinned plugin on four major AI coding agents without any user action. AIR calls it "the first supply chain vulnerability of the AI agent ecosystem" and reports that "925 skills already in active use had been hijacked," reaching "134,000 agents."
The bug breaks SHA pinning, the mechanism that is supposed to lock a plugin to a specific reviewed commit. AIR found that every one of the four agents "checks out the pinned commit without verifying the checkout landed there." Create a branch whose name matches the plugin's 40-character commit hash, make it the default branch, and git resolves the reference before the commit object, because "git prefers a ref over a commit of the same name." The install reports the expected SHA. The malicious code runs.
"The victim only has to have a plugin installed, from a marketplace they trust, that was reviewed," AIR writes. Zero-click, because "the same git checkout re-runs on background auto-update."
Anthropic shipped a fix in Claude Code 2.1.179 and OpenAI patched Codex in 0.146.0. Microsoft has not released a Copilot fix. Google is not patching Gemini CLI, having deprecated it and pointed users at Antigravity.
AIR researchers Or Nevo, Dor Granat and Niv Hoffman found the bug in May 2026 and disclosed it to vendors the following month.
What others are reporting
-
AIR Security Read →
Original research by Or Nevo, Dor Granat, Niv Hoffman. Details two distinct exploit paths: branch-naming bypass and FETCH_HEAD confusion, with full vendor remediation timeline.
The pin is resolved inside the agent, so only an agent-side fix restores the guarantee.
-
Cyber Security News Read →
Explains the SHA-naming bypass mechanic and flags that self-hosted Git servers remain exploitable for Copilot users even after GitHub marketplace mitigations.
The flaw allows a malicious plugin update to execute attacker-controlled code without requiring user approval or reinstall.
-
CSO Online Read →
Enterprise risk framing with analyst commentary on CI/CD and credential exposure; argues fix obligation falls on vendors, not enterprise security teams or marketplace operators.
It's a flaw no marketplace can fix, so users must update their agent.
Originally reported by helpnetsecurity.com
Read the original article →Original headline: Plugin4Shell Zero-Click RCE Hits Claude Code, Codex, Copilot and Gemini CLI Plugin Systems