← Back to feed

Air Security today published Plugin4Shell, a disclosure of a zero-click remote code execution vulnerability affecting Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI. The flaw is not in the models. It is in the SHA-pinning mechanism that agent marketplaces rely on to guarantee plugin integrity — and every major lab made the same implementation error independently.

How the Bypass Works

Plugin marketplaces protect against supply-chain tampering by pinning plugins to a specific commit SHA. The assumption is that a pinned SHA is immutable: the code reviewed at that commit is the code that runs. Plugin4Shell breaks that assumption.

The agent checks out the exact commit the marketplace pinned but never verifies that the local checkout resolved to that commit. An attacker who controls a plugin’s repository can make the checkout resolve to malicious code while the pin appears honored. No user action is required. The plugin executes automatically, and the attacker gains full remote code execution on the developer’s machine — and through it, everything the agent can reach: source code, secrets, production credentials, internal systems.

Third in a Series

Air Security has been building this story across three disclosures. In The Story of Skills, they built a malicious plugin, watched it go viral on a community marketplace, and gained control of 26,000 agents. In SkillJacking, they demonstrated that planting code is not even necessary: 925 existing plugins could be hijacked by taking over the repositories backing them, exposing 134,000 agents. SHA pinning was the industry’s stated answer to SkillJacking. Plugin4Shell is what happens to that answer.

The Four Affected Agents

Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI are confirmed affected. The flaw is not an implementation slip in one product — it is the same design error made independently across four separate codebases by four separate teams.

Gemini CLI has a distinct variant that differs from the other three. A partial marketplace-side mitigation — restricting plugin hosts to those that reject SHA-shaped branch names, effectively limiting hosts to GitHub — could blunt one attack path, but it bans hosts those agents officially support and does nothing for Gemini CLI’s variant. A complete fix requires changes inside the agent itself.

Blast Radius

An agent runs with the full permissions of the developer operating it. A malicious plugin inherits those permissions without any escalation step. In enterprise deployments, that means access to internal systems and production environments. Air Security notes the exposure extends to any user who has installed plugins, not only those who installed them carelessly.

Developers using Air Marketplace and Air Filter were not affected by Plugin4Shell.

Patch Status

Air Security followed responsible disclosure procedures before today’s publication. Anthropic shipped a fix in Claude Code v2.1.179 on June 17, 2026. OpenAI shipped Codex CLI v0.146.0 on July 29, 2026, which included the fix; Air Security confirmed remediation on August 12, 2026. Google deprecated Gemini CLI without issuing a patch. Microsoft had not released a fix for GitHub Copilot as of public disclosure.

This is the third major supply-chain disclosure in the AI coding agent category this year, each demonstrating that the attack surface has shifted from the model itself to the distribution layer below it.