Plugin4Shell: unchecked git pins gave zero-click RCE across AI agent plugin stores

According to a write-up on dev.to, researchers at Air Security uncovered a zero-click remote code execution vulnerability spanning the plugin marketplaces of every major AI coding agent. Dubbed Plugin4Shell, the flaw affects Claude Code, OpenAI Codex, GitHub Copilot and Google Gemini CLI, and traces back to a shared architectural mistake: agents pin plugins to specific git commit SHAs but never verify that the code they actually checked out matches the pin.

The research dates to May 2026, according to the post. Before a proof-of-concept plugin was detected and pulled, it had reached more than 26,000 agents. A parallel campaign the researchers call SkillJacking compromised 925 skills already in active production use, affecting roughly 134,000 agents.

A pin nobody checked

The integrity model looks sound on paper. Plugin marketplaces pin each plugin to a commit SHA, the same kind of guarantee Docker image digests or Go's go.sum checksums provide. But the agents reportedly run a git checkout against the SHA and move on. Git's reference resolution has a priority order, and when a branch name matches or partially matches the SHA, git may resolve to the branch instead of the commit. An attacker who controls a plugin repository can create a branch whose name is the 40-character hex string of the pinned SHA; git finds the branch, checks out its head — the attacker's code — and the agent proceeds as though the pinned commit had loaded.

The zero-click element comes from update behavior. Claude Code and Codex update installed plugins automatically in the background by default, so when the pinned SHA is bumped, the swapped code reaches already-installed plugins without any user action, the post explains.

Different paths, same outcome

Claude Code, Codex and Copilot share the branch-name collision variant, according to the write-up. Gemini CLI has a distinct mechanism involving FETCH_HEAD branch naming during checkout operations, but the outcome is identical.

Hosting matters as well. GitHub blocks 40-character hexadecimal branch names on its platform, which blunts the attack for plugins hosted there. Bitbucket, GitLab and self-hosted git servers impose no such restriction, so plugins that source code from those hosts remain fully exposed.

A split vendor response

Anthropic patched Claude Code in v2.1.179, verifying after checkout that the working tree matches the pinned SHA. OpenAI fixed Codex in v0.146.0 using the same post-checkout verification approach. Google, per the post, deprecated Gemini CLI rather than patching it, leaving existing users exposed until they migrate to a replacement. GitHub had issued no Copilot fix at disclosure time; the write-up notes that the GitHub-hosting mitigation lowers risk for GitHub-sourced plugins, but Copilot also supports plugins from other git hosts where that protection does not apply.

The npm parallel, with wider permissions

The write-up maps Plugin4Shell directly onto a decade of package-registry attacks. Typosquatting becomes skill squatting, with similarly named skills registered to intercept common workflows. Dependency confusion becomes plugin confusion, where resolution order across marketplace, local and git-URL sources decides which version loads. Maintainer compromise becomes repository takeover, with push access letting an attacker change what a SHA-pinned checkout retrieves.

The stakes are higher than npm, the post argues, because of permissions. An npm package runs with the host application's access, while an agent plugin runs with the agent's — typically file system access, shell execution and network access. A compromised plugin can rewrite a codebase, exfiltrate SSH keys or plant a backdoor in a CI pipeline.

Why it matters

This is the point at which AI coding agents inherited the entire attack surface of package managers, plus an auto-updating code-execution channel that package registries never had. A plugin installed months ago can be retroactively weaponized through its own update mechanism, and the agent pulls the malicious version silently. The vendor response is inconsistent — two shipped fixes, one tool abandoned, one unpatched — so exposure depends heavily on which agent and which git host you use.

For teams, the post recommends updating to Claude Code 2.1.179+ or Codex 0.146.0+, auditing installed plugins and where they source code (especially non-GitHub hosts), disabling automatic updates until that audit is done, and forking critical plugins to organization-controlled hosting.

One caveat: the figures and patch statuses above come from a single dev.to write-up of Air Security's research and have not been independently confirmed for this report.