Critical Plugin4Shell RCE Flaw Impacts AI Coding Assistants

Key Takeaways

• A critical zero-click RCE vulnerability, dubbed Plugin4Shell, has been discovered in popular AI coding assistants.
• The flaw impacts Anthropic Claude Code, OpenAI Codex, GitHub Copilot, and Google Gemini CLI, allowing attackers to execute arbitrary code via malicious plugin updates.
• Plugin4Shell exploits weaknesses in how these AI agents handle SHA-pinned plugin versions, enabling a supply chain attack.
• Patches are available for Claude Code (v2.1.179) and Codex (v0.146.0); Google Gemini CLI is deprecated. GitHub Copilot remains unpatched, though GitHub states its platform mitigates some attack vectors.

Major AI Coding Assistants Vulnerable to Zero-Click RCE via Plugin4Shell

A severe remote code execution (RCE) vulnerability, tracked as Plugin4Shell, has been identified in several prominent AI coding assistants, including Anthropic Claude Code, OpenAI Codex, GitHub Copilot, and Google Gemini CLI. This high-severity flaw enables attackers to execute arbitrary code on a developer’s system without any user interaction, simply through a malicious plugin update.

The Plugin4Shell vulnerability targets the software supply chain infrastructure behind these AI agents, rather than the underlying AI models themselves. Modern coding assistants frequently integrate plugins, skills, and extensions sourced from community marketplaces. These add-ons often inherit extensive permissions from the developer executing the agent, potentially granting access to sensitive assets like local source code, cloud credentials, SSH keys, internal repositories, production systems, and various secrets.

Exploiting Flawed SHA-Pinning

The core of the issue lies in how affected AI agents manage SHA-pinned plugin versions. Marketplace systems typically pin a plugin to a specific Git commit hash after an initial review process. This mechanism is designed to ensure that the agent installs the exact, approved version of the code, preventing the deployment of unauthorized or modified versions.

However, researchers at Air Security found that while the vulnerable agents request the specified pinned commit, they fail to adequately verify that the checked-out working tree precisely matches that commit. This oversight allows an attacker who controls a plugin’s repository to manipulate Git’s reference resolution, forcing the agent to check out a malicious branch while still appearing to adhere to the approved SHA pin.

Zero-Click Attack Vector

For Claude Code, Codex, and GitHub Copilot, the attack can be executed by creating a Git branch with a name identical to the plugin’s 40-character commit hash. Git’s internal mechanisms may prioritize a matching reference name over the direct commit object during the checkout process. If this identically named branch contains malicious code, the agent will install it, yet report a successful installation based on the expected SHA.

Google Gemini CLI exhibits a distinct variant of the vulnerability. Its plugin process fetches the intended commit and subsequently checks out FETCH_HEAD. Air Security researchers discovered that an attacker could exploit a repository branch named FETCH_HEAD to redirect the checkout operation to malicious content instead of the legitimate fetched commit.

The “zero-click” nature of Plugin4Shell stems from the automatic plugin update mechanisms prevalent in these tools. Claude Code and Codex, for instance, update installed plugins in the background by default. This eliminates the need for an attacker to trick a victim into installing a new plugin. Instead, an attacker could initially publish a benign-looking plugin, gain user adoption, and then surreptitiously modify the upstream repository. Alternatively, compromising an existing, legitimate plugin maintainer’s repository could achieve the same outcome.

This risk is particularly significant for enterprises that deploy AI coding agents with broad access to critical development and production environments. A successful exploit could grant an attacker the same level of access as the compromised developer’s account, potentially exposing proprietary source code, API keys, CI/CD credentials, internal systems, and cloud infrastructure.

Patch Status and Mitigation

Anthropic has addressed the vulnerability in Claude Code version 2.1.179, and OpenAI has patched Codex in version 0.146.0. Google has stated that Gemini CLI is deprecated and will not receive a fix, advising users to migrate to Antigravity.

As of the disclosure, Microsoft had not issued a fix for GitHub Copilot. GitHub indicated that its platform implements blocking mechanisms for SHA-like branch and tag names. However, Air Security contends that marketplaces hosted on other services, such as Bitbucket or self-hosted Git servers, may still be susceptible to exploitation.

What You Should Do

• Update Immediately: Ensure Anthropic Claude Code is updated to version 2.1.179 and OpenAI Codex to version 0.146.0 or higher.
• Migrate from Gemini CLI: If using Google Gemini CLI, migrate to Antigravity as recommended by Google.
• Review Plugin Inventory: Conduct a thorough audit of all installed plugins in your AI coding agents.
• Restrict Plugin Sources: Limit plugin installations to trusted and verified sources whenever possible.
• Monitor Repositories: Actively monitor plugin repositories for any unexpected branch changes, ownership transfers, or suspicious activity.
• Implement Post-Installation Verification: For vendors and developers managing custom plugin systems, verify the actual checked-out commit after installation by comparing the resolved HEAD value with the marketplace-pinned SHA.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.