Plugin4Shell: a zero-click flaw in Claude Code, Codex, Copilot and Gemini CLI - what to check before your agents auto-update
AIR disclosed a zero-click RCE that bypasses plugin SHA pinning in four AI coding agents. Two are patched, two are not. Here is what to do.
Security firm AIR published a report on 17 September describing Plugin4Shell, a zero-click remote code execution flaw in four AI coding agents: Claude Code, OpenAI's Codex, GitHub Copilot and Gemini CLI. A malicious plugin update can run attacker code on the machine with no click, approval or reinstall. Anthropic and OpenAI have patched. Microsoft and Google have not.
What happened
Plugins in these agents are locked to a specific commit, identified by a SHA. The idea is that a reviewed version stays the reviewed version. According to AIR, "every one of the four agents checks out the pinned commit without verifying the checkout landed there."
In Claude Code, Codex and Copilot, the trick involves git branch names. The Register and other outlets describe an attacker creating a branch named after the plugin's 40-character commit hash. Git can resolve that name to the branch instead of the commit, so the agent installs malicious code while reporting that the pinned version installed fine. Gemini CLI fails through a different mechanism in how commits are fetched.
AIR reported the flaw to all vendors in June. Public disclosure came on 17 September, per The Register.
Why it is worse than a normal install bug
AIR points out this is not only an install-time problem. The same checkout runs again on background auto-update, which is the default in Claude Code and Codex. If a marketplace bumps the pinned SHA, the swap reaches plugins that are already installed, with no user action.
There are two attack routes. Publish a harmless plugin, pass review, then turn it malicious. Or take over an existing plugin's repository and push bad code to every installed copy. What the attacker gets, in AIR's words, is access to "every asset and piece of data that the agent can reach."
Patch status
- Anthropic: fixed in Claude Code 2.1.179.
- OpenAI: fixed in Codex 0.146.0.
- Microsoft: no fix for Copilot, according to the reports. Some coverage says a SHA restriction mitigates it, but the researchers dispute that it works.
- Google: no patch. Gemini CLI is deprecated and Google points users to Antigravity.
I could not find a CVE identifier in the coverage I read.
What it means for a business owner
Most small businesses do not run coding agents on production servers. But the pattern is the point. Any agent that pulls in third-party plugins, skills or tools and auto-updates them has this shape of risk. That includes automation stacks built from marketplace connectors.
Ask what your agent can reach. A coding agent on a developer laptop can usually see source code, cloud credentials, API keys and internal repos. If a plugin swap runs code as that agent, all of it is exposed. The damage depends on the permissions, not on the model.
This is also a handover question. When we build an automation for a client, the client should be able to see every external component it depends on and decide when each one changes. Silent auto-update of third-party code is convenient for the vendor. It is a liability for the owner.
The honest caveat
This is a supply chain bug, not proof that AI agents are unsafe in general. The same class of flaw has hit package managers for years. Patching works when vendors patch, and two of the four did within months of the June report. No public reporting I found describes this being exploited against a real company. Also, the report leaned on vendor and researcher statements. Microsoft's position in particular is only partly documented in what I read.
What to do about it
1. Update Claude Code to 2.1.179 or later and Codex to 0.146.0 or later. If your team uses Gemini CLI, plan the move off it, since it will not be fixed. 2. Turn off plugin auto-update where you can, and install plugins only from sources you have reviewed. 3. Run agents with the least access they need. Separate credentials for the agent, not your personal ones. 4. Keep a list of every plugin and skill each agent uses, with who approved it.
If you cannot produce that list today, that is the first job.
Want this kind of system in your business? Book a free scoping call.