Plugin4Shell zero-click flaw breaks SHA pinning in Claude Code, Codex, GitHub Copilot and Gemini CLI
AIR researchers say every one of the four agents checks out a pinned plugin commit without verifying the checkout landed there, and two remain unpatched.
Evidence: Independent reports. Security stories run only with a named disclosure or independent reporting behind them.
Researchers at AIR have disclosed a zero-click remote code execution vulnerability shared by four major AI coding agents: Claude Code, Codex, GitHub Copilot and Gemini CLI. Dubbed Plugin4Shell, the bug defeats SHA pinning, the mechanism developers rely on to lock an installed plugin to a specific, reviewed version of its code. AIR found that each of the four agents checks out the pinned commit without verifying that the checkout actually landed there, allowing an attacker to swap in malicious code while the pin still appears intact. The researchers describe this as a plugin SHA-pinning bypass and call it the first supply chain vulnerability of the AI agent ecosystem. Exposure is not limited to careless users: a victim only needs a plugin installed from a trusted marketplace, reviewed and pinned exactly as the security model intends. A successful attack gives the intruder the same reach into a company's systems and data as the employee running the agent. According to Help Net Security, two of the four agents remain unpatched. SecurityWeek included the attack in its weekly roundup alongside Mandiant's 2026 AI Risk and Resilience report, which finds attackers have moved from prompting chatbots for research to letting autonomous agents run entire intrusions, and a $35 million Series A for Raindrop, a startup that monitors autonomous agents for silent failures. Organizations running any of the four agents with marketplace plugins should check for vendor fixes.