Plugin4Shell: zero-click plugin flaw hits Claude Code, Codex, Copilot and Gemini CLI

What happened

Security research firm AIR Security has disclosed a vulnerability it calls Plugin4Shell, a zero-click flaw affecting four widely deployed AI coding agents: Anthropic's Claude Code, OpenAI's Codex, Microsoft's GitHub Copilot and Google's Gemini CLI. According to a dev.to write-up summarising the research, the flaw lets whoever controls a plugin's repository silently replace code that has already passed marketplace review and version pinning, with no action required from the user. AIR Security claims millions of agents are affected.

What distinguishes this from typical plugin malware is the target: not careless users, but people who did everything by the book, installing from a trusted marketplace, waiting for review and pinning versions.

How the SHA-pinning bypass works

Marketplace review for these agents works by recording the commit hash of the approved plugin version. The agent then locks to that SHA and pulls only the matching commit on install or update. In theory, later changes by the repository owner never reach users.

The gap is that the agent issues a checkout for that number but never verifies that what it fetched actually matches the hash. AIR Security calls this a SHA-pinning bypass, and demonstrated two working paths.

For Claude Code, Codex and Copilot, the researchers exploited git's resolution order: when a requested name collides with a commit identifier, git prefers the branch. An attacker controlling the repo creates a branch whose name is the same hex string as the pinned hash and fills it with malicious code, so the agent's checkout retrieves the fake branch rather than the reviewed commit.

Gemini CLI uses a different fetch and checkout mechanism, but the researchers report the same end result.

There is a constraint worth noting: the branch-name trick requires a git host that accepts hash-like branch names. GitHub reportedly rejects branch names that are exactly 40 hexadecimal characters, while Bitbucket and self-hosted git servers allow them.

Why it is zero-click

The zero-click label does not apply only to first installation. Claude Code and Codex run background updates by default, so once the pinned SHA is moved, the swapped code propagates to every machine that already has the plugin installed, without the user touching anything.

Two scenarios backed by earlier fieldwork

The researchers point to prior measurements to argue the scenarios are realistic. In earlier testing, a plugin their team published spread to 26,000 agents before being withdrawn. A separate study, SkillJacking, found 925 skills in active use had been taken over from their original owners, reaching 134,000 agents, which the team presents as evidence that mass repo takeover is already happening.

Patch status: two fixed, one pending, one abandoned

The researchers found the flaw in May with working proofs of concept for all four agents and notified the vendors the following month, according to the dev.to write-up. As Help Net Security summarised, the responses diverged sharply.

Anthropic patched Claude Code in version 2.1.179. OpenAI patched Codex in version 0.146.0. Microsoft has not released a patch for Copilot, leaving those users without a fix for now. Google chose to discontinue Gemini CLI rather than patch it, advising migration to a newer agent, Antigravity, built without the legacy plugin-pinning mechanism, which means existing Gemini CLI installations remain exposed.

A key detail: the missing verification lives in the agent, not the marketplace. No marketplace-side change can fully close the hole; the only complete remedy is updating to a patched agent.

What to do now

Update Claude Code to 2.1.179 or later and Codex to 0.146.0 or later. Copilot users should track Microsoft's patch announcements closely and hold off on installing unfamiliar plugins in the meantime. Gemini CLI users should weigh migrating, since no patch is coming for the current tool.

In all cases, audit installed plugins to confirm their repositories are still controlled by the original owners, especially older plugins with no recent updates, the profile most hijacked repos fit in the SkillJacking data.

Why it matters

The AI agent ecosystem is reprising the software supply-chain story at speed: an initial race to ship features, a growing web of trust relationships, and then the discovery that trust itself is the attack surface. Plugin and skill marketplaces are becoming the npm of this era, and the old lesson is returning, that reviewed does not mean safe unless the endpoint verifies what it actually received. Until agents cryptographically confirm that fetched code matches the pinned hash, version pinning is a promise rather than a guarantee, and every marketplace built on it inherits that gap.