A newly disclosed zero-click remote code execution vulnerability designated as Plugin4Shell has been identified across four prominent AI coding agents: Claude Code, Codex, GitHub Copilot, and Gemini CLI.
According to security researchers at AIR, the flaw represents the first supply chain vulnerability affecting the broader AI agent ecosystem. The security defect allows malicious actors to achieve code execution with the same organizational privileges and data access as the employee operating the agent.
“It is the first supply chain vulnerability of the AI agent ecosystem,” researchers stated. “Anyone running a major coding agent that installs plugins from a marketplace is exposed. The exposure is not limited to users who install plugins carelessly: the victim only has to have a plugin installed, from a marketplace they trust, that was reviewed and pinned exactly as the security model intends.”
The core mechanic of Plugin4Shell relies on a plugin SHA-pinning bypass that breaks the cryptographic verification developers utilize to lock installed extensions to specific, audited commits. The vulnerability enables attackers to swap out legitimate code with malicious payloads while maintaining an intact pin appearance. While Claude Code, Codex, and GitHub Copilot share a variant linked to git branch naming conventions, Gemini CLI is affected by a separate checkout handling mechanism.
The threat is exacerbated by background auto-update functionalities native to platforms like Claude Code and Codex, which automatically execute git checkouts during routine updates. Researchers noted that the attack vector functions on git hosts and self-hosted servers that permit branch names formatted as 40-character hexadecimal hashes, unlike GitHub which outright rejects such naming conventions.
Vendor response to the disclosures has been fragmented since researchers reported the issues in June 2026. Anthropic addressed the flaw in Claude Code version 2.1.179, and OpenAI issued a patch for Codex in version 0.146.0. However, Microsoft has not released a remediation for GitHub Copilot, while Google opted to deprecate Gemini CLI entirely rather than deploy a patch, instructing users to migrate to its newer Antigravity agent.