Plugin4Shell: SHA-pinning bypass gives zero-click RCE in Claude Code, Copilot, Codex, Gemini CLI

What the disclosure claims

Security firm Air Security has published research on a vulnerability it names Plugin4Shell, describing zero-click remote code execution across the four most popular AI coding agents: Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI. According to the post, which surfaced on Hacker News's front page after publication on September 18, millions of agents are exposed. The flaw sits in the supply-chain layer beneath the agents — the marketplaces through which plugins and skills are distributed — rather than in any one product, which the firm calls the first supply-chain vulnerability of the AI agent ecosystem.

How the pinning bypass works

The standard defence against malicious plugin updates is SHA pinning: review the code at one commit, pin that commit, and trust that the pinned code is what runs thereafter. Air Security says every affected agent checks out the pinned commit but never verifies that the checkout actually landed there, and that this one missing check is the whole bug.

The exploit rests on a quirk of git. Claude Code, Codex and GitHub Copilot clone a plugin repository and check out the 40-hex pinned SHA. An attacker who controls the upstream repository can create a branch whose name is exactly that SHA and make it the default branch. When a name is both a valid ref and an object ID, git prefers the ref and emits only a "refname is ambiguous" warning, so the checkout silently resolves to the attacker's branch whether or not the pinned commit still exists. The branch must be the default, the post notes, since a non-default branch arrives only as a remote-tracking ref and the checkout would fall back to the commit. Gemini CLI is listed as affected through a variant of the technique.

Not every host permits this. GitHub rejects 40-hex branch names outright, while Bitbucket and self-hosted git servers allow them — and marketplaces on those hosts are a supported configuration for the agents, according to the post.

Where the zero click comes from

Plugin auto-update is what makes the attack zero-click, and it runs in the background by default in Claude Code and Codex. In the demonstrated chain, an attacker ships a benign plugin and lets the marketplace pin it. When a routine update re-pins to a new commit, the attacker creates a default branch named after that new SHA and points it at malicious code. The pin change triggers every installed agent's background update, the checkout resolves to the branch, and the malicious version runs with no install prompt and no user action. Because plugins inherit the permissions of the employee running the agent, the attacker gains the same reach over sensitive data, internal systems and production environments.

Two paths to the repository

Neither path requires controlling the marketplace. An attacker can publish a genuinely benign plugin and swap its contents later, or hijack the repository behind a plugin someone else wrote. Air Security says it has demonstrated both ends in the wild: an earlier experiment planted a malicious skill that went viral and seized control of more than 26,000 agents, and a separate study found 925 skills in active use had been hijacked away from their maintainers, affecting 134,000 agents.

Why a marketplace cannot fully fix it

Because the pin is resolved inside the agent, only an agent-side fix restores the guarantee, the post argues. A marketplace can blunt one variant by allowing only hosts that reject SHA-shaped names — effectively GitHub-only — but that bans hosts the agents officially support and does nothing for Gemini CLI's variant.

Why it matters

If the findings hold, this is a structural failure shared by every major coding agent, and it defeats the review-and-pin workflow enterprises adopted precisely to make community plugins safe. Vetting the marketplace, reviewing the code and pinning the commit would not have helped.

Two caveats belong alongside the alarm. The disclosure is single-sourced from Air Security, a vendor that sells its own marketplace and filtering products and states that its enterprise customers were unaffected; no independent verification or vendor responses appear in the material. And because remediation depends on agent-side patches, organisations running these tools should, until fixes land, treat every installed plugin as executing with the user's full authority — because, by design, it does.