Plugin4Shell Zero-Click RCE Vulnerability Disclosed: Two of Four AI Coding Assistants Still Unpatched

On September 18, 2026, security firm AIR publicly disclosed the Plugin4Shell vulnerability, which affects four mainstream AI coding assistants: Claude Code, Codex, GitHub Copilot, and Gemini CLI. Anthropic's Claude Code v2.1.179 and OpenAI's Codex 0.146.0 have completed fixes, Microsoft has not yet provided a patch for Copilot, and Google has chosen to deprecate Gemini CLI.

Factual Reconstruction

According to AIR's research, Plugin4Shell is the first documented supply-chain-level vulnerability in the AI agent ecosystem. Attackers do not need a user click; they only need to create a Git branch with the same name as the plugin's SHA hash to inject malicious code into an installed plugin, thereby taking over local code repositories, cloud credentials, and SSH keys. The vulnerability was discovered in May 2026 and disclosed to vendors in June.

The findings show that SHA pinning is intended to lock the plugin version, but the four agents did not verify the actual checkout location when checking out the pinned commit, allowing attackers to replace malicious code while keeping the pinning appearance intact.

Mechanism Breakdown

There are two exploitation paths for the vulnerability. In the first, an attacker first publishes a seemingly normal plugin that passes review, then injects malicious code through branch replacement; in the second, an attacker takes over a trusted plugin repository and uses the same bypass mechanism to push malicious updates. AIR's earlier SkillJacking research has already proven that repository takeover can occur at scale.

The zero-click characteristic stems from the background automatic update mechanism, which is enabled by default in Claude Code and Codex. When the marketplace updates the pinned SHA, malicious code can spread without user intervention. Gemini CLI is exposed through a separate fetch and checkout mechanism.

Industry Impact

The vulnerability directly affects developers who have installed and reviewed plugins correctly according to the security model, and the exposure is not limited to careless users. Anthropic and OpenAI closed the loop through fixes in the agents themselves; Microsoft's Copilot remains unpatched, while Google has deprecated Gemini CLI and recommends migrating to its new agent Antigravity.

Because the checking logic resides in the agents rather than the marketplace, the marketplace cannot provide protection on its own; fixes must be completed by each vendor on the agent side.

Strategic Assessment

[Analysis] The trust assumptions of mainstream AI coding assistants have been broken at the supply chain level. Differences in vendors' patch response speeds may bring compliance and adoption risks; Google's approach of deprecating a product rather than patching it reflects diverging degrees of reliance on plugin pinning mechanisms among vendors, which may accelerate migration by some users to agents without pinning systems.

[Analysis] Historical supply chain vulnerabilities have mostly been concentrated at the installation stage, while Plugin4Shell's combination of zero-click and automatic updates extends its impact into runtime, highlighting the reality that users in the AI agent ecosystem who "did everything right" still face continuous exposure.