A critical zero-click vulnerability in AI coding assistants could let attackers execute malicious code on millions of machines, security researchers warn.
The flaw, dubbed Plugin4Shell, affects Claude Code, OpenAI’s Codex, Google’s Gemini CLI, Microsoft’s Copilot, and GitHub Copilot. According to researchers at Air, an enterprise AI security firm, attackers who exploit the vulnerability can gain full access to every asset and piece of data the compromised agent can reach.
Air’s researchers—Or Nevo, Dor Granat, and Niv Hoffman—describe Plugin4Shell as the first fully automated AI supply-chain attack. Rather than targeting the AI model or agent itself, the exploit targets the trusted marketplaces that host plugins for these coding assistants, meaning a successful attack could cascade across millions of users and machines.
How the Attack Works
The vulnerability exploits a weakness in how AI agents enforce SHA-pinning, a security mechanism that locks plugins and skills to a specific, immutable commit hash. This mechanism is designed to prevent supply-chain attacks: if a public repository is compromised, the agent should continue running the original, audited code version instead of pulling new malicious updates.
But the researchers found a critical gap. “The agent checks out the exact commit the marketplace pinned but never verifies it landed there,” Nevo, Granat, and Hoffman wrote. “An attacker who controls the plugin repo makes the checkout resolve to malicious code while the pin still looks honored.” The result is zero-click remote code execution—no user interaction required.
The agents’ default plugin auto-update feature enables the attack. When a pinned commit is swapped upstream, the plugin gets silently replaced with a malicious version. Both Claude and Codex automatically update installed plugins by default.
Attack Vectors
The Air team identified two possible attack paths. In the first, an attacker publishes a benign plugin to a trusted marketplace, passes review, and later replaces the benign code with malicious payloads. The second involves hijacking a legitimate author’s repository and pushing a malicious version to every agent that has installed it—directly bypassing the SHA-pinning mechanism meant to prevent exactly this scenario.
Vendor Patch Status
Air reported the vulnerability to all four vendors in June. Anthropic patched Claude Code in version 2.1.179, and OpenAI issued a fix in Codex 0.146.0. Google has deprecated the Gemini CLI and will not issue a patch, instead directing users to migrate to its newer Antigravity agentic development environment, which the company says is protected.
Microsoft has not patched Copilot. Air said it also reported the flaw to Microsoft in June but received no response due to the company’s disclosure volume. Microsoft did not respond to The Register’s request for comment.
GitHub Copilot disputed the vulnerability’s applicability to its product. A GitHub spokesperson said the platform prevents users from creating branch or tag names that resemble commit SHAs, which blocks the attack vector. However, Air researchers argued the mitigation is insufficient. “Because marketplaces can also be hosted on other platforms such as Bitbucket, GitHub’s fix doesn’t fully address the issue,” they told The Register. “Microsoft Copilot remains vulnerable because it supports marketplaces from platforms like Bitbucket, which exposes it to the attack.”
Research Context
The vulnerability builds on earlier work by the Air team, which demonstrated similar attack techniques through their SkillJacking and RepoJacking proof-of-concept exploits. “Together, the chain is proven end-to-end—takeovers happen at scale, and Plugin4Shell defeats the mechanism built to contain them,” the researchers wrote.
Nearly 90 percent of Fortune 500 companies use Copilot, according to Microsoft, placing the unpatched vulnerability among the most consequential attack surfaces in enterprise environments today.