Plugin4Shell Vulnerability Exposes Major AI Coding Agents to Zero-Click RCE

Summary

Researchers say a zero-click remote-code-execution vulnerability called Plugin4Shell affects major AI coding agents, including Anthropic’s Claude Code, OpenAI’s Codex, Google’s Gemini CLI, Microsoft’s Copilot, and Microsoft-owned GitHub Copilot. The flaw targets trusted plugin marketplaces rather than the underlying models, potentially allowing malicious code to reach every machine and asset an agent can access. It abuses the agents’ SHA-pinning mechanism: an agent checks out the commit referenced by a marketplace but does not verify that the reference still resolves to that exact commit. An attacker controlling a plugin repository can therefore make the pinned checkout resolve to malicious code while appearing compliant. Automatic plugin updates make exploitation zero-click; researchers describe both a reviewed plugin later replaced by its author and a takeover of a legitimate repository as attack paths. Anthropic and OpenAI patched Claude Code 2.1.179 and Codex 0.146.0. Google will not patch the deprecated Gemini CLI and says users should migrate to Antigravity, while Microsoft did not patch Copilot. GitHub says its SHA-like branch and tag restrictions prevent exploitation on GitHub, but the researchers argue that Copilot remains exposed when it uses marketplaces hosted elsewhere, such as Bitbucket.