Critical Zero-Click RCE Flaw Found in Major AI Coding Agents
Researchers at AIR (AI Incident Response) have uncovered a severe zero-click remote code execution (RCE) vulnerability, dubbed Plugin4Shell, affecting four leading AI coding agents: Claude Code, Codex, GitHub Copilot, and Gemini CLI. The flaw allows attackers to bypass SHA pinning a security mechanism designed to lock plugins to verified versions granting them the same access to systems and data as the user running the agent.
How the Vulnerability Works
The bug exploits weaknesses in how these agents verify pinned plugin commits. Normally, SHA pinning ensures that once a plugin passes review, its code cannot be altered without detection. However, AIR found that all four agents fail to confirm whether the checked-out code matches the pinned commit, enabling attackers to swap in malicious code while the pin appears intact.
- Claude Code, Codex, and GitHub Copilot share a flaw tied to Git’s handling of branch names, where a branch can be named like a hash.
- Gemini CLI has a separate issue in its commit-fetching process, leading to the same outcome.
The attack is particularly dangerous because it is zero-click exploitable even on auto-updating plugins without user interaction. Since the vulnerability persists in background updates, already-installed plugins remain at risk.
Attack Vectors
AIR demonstrated two primary methods for exploitation:
- Malicious Plugin Takeover – An attacker publishes a legitimate plugin, passes review, and later replaces it with malicious code.
- Repository Hijacking – An attacker compromises a trusted plugin’s repository (as seen in AIR’s SkillJacking research, where 925 hijacked plugins reached 134,000 agents).
Vendor Responses
AIR disclosed the flaw to vendors in June 2026 after discovering it in May 2026:
- Anthropic patched Claude Code (v2.1.179).
- OpenAI fixed Codex (v0.146.0).
- Microsoft has not released a patch for GitHub Copilot, leaving users exposed.
- Google deprecated Gemini CLI entirely, advising users to migrate to Antigravity, a newer agent without the vulnerable plugin system.
Since the issue lies within the agents themselves, marketplace protections alone are insufficient. The only complete fix requires vendor updates, leaving some users indefinitely vulnerable.
Source: https://www.helpnetsecurity.com/2026/09/18/plugin4shell-ai-coding-agents-vulnerability/
Microsoft Security Response Center cybersecurity rating report: https://www.rankiteo.com/company/microsoft-security-response-center
Anthropic cybersecurity rating report: https://www.rankiteo.com/company/anthropicresearch
OpenAir cybersecurity rating report: https://www.rankiteo.com/company/openair
"id": "MICANTOPE1789727167",
"linkid": "microsoft-security-response-center, anthropicresearch, openair",
"type": "Vulnerability",
"date": "5/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'AI/Technology',
'name': 'Anthropic',
'type': 'Vendor'},
{'industry': 'AI/Technology',
'name': 'OpenAI',
'type': 'Vendor'},
{'industry': 'AI/Technology',
'name': 'Microsoft',
'type': 'Vendor'},
{'industry': 'AI/Technology',
'name': 'Google',
'type': 'Vendor'},
{'customers_affected': '134,000+ agents (via hijacked '
'plugins)',
'name': 'Users of Claude Code, Codex, GitHub Copilot, '
'and Gemini CLI',
'type': 'End Users'}],
'attack_vector': ['Malicious Plugin Takeover', 'Repository Hijacking'],
'date_detected': '2026-05',
'description': 'Researchers at AIR (AI Incident Response) uncovered a severe '
'zero-click remote code execution (RCE) vulnerability, dubbed '
'Plugin4Shell, affecting four leading AI coding agents: Claude '
'Code, Codex, GitHub Copilot, and Gemini CLI. The flaw allows '
'attackers to bypass SHA pinning, enabling malicious code '
'execution with the same access as the user running the agent. '
'The vulnerability is zero-click exploitable and persists in '
'background updates.',
'impact': {'brand_reputation_impact': 'Potential reputational damage to '
'affected vendors (Anthropic, OpenAI, '
'Microsoft, Google)',
'operational_impact': 'Potential unauthorized access to systems '
'and data with user-level permissions',
'systems_affected': ['Claude Code',
'Codex',
'GitHub Copilot',
'Gemini CLI']},
'post_incident_analysis': {'corrective_actions': ['Vendor patches for SHA '
'pinning verification',
'Deprecation of vulnerable '
'systems (Gemini CLI)'],
'root_causes': ['Failure to verify checked-out '
'code matches pinned commit in SHA '
'pinning',
'Git branch naming flaw (Claude '
'Code, Codex, GitHub Copilot)',
'Commit-fetching process flaw '
'(Gemini CLI)']},
'recommendations': ['Update to patched versions of affected agents (Claude '
'Code v2.1.179, Codex v0.146.0)',
"Migrate from Gemini CLI to Antigravity (Google's "
'recommended alternative)',
'Monitor for vendor updates for GitHub Copilot (unpatched '
'as of disclosure)',
'Review plugin repositories for signs of hijacking or '
'malicious code'],
'references': [{'source': 'AIR (AI Incident Response)'}],
'response': {'remediation_measures': ['Anthropic patched Claude Code '
'(v2.1.179)',
'OpenAI patched Codex (v0.146.0)',
'Google deprecated Gemini CLI '
'(migration to Antigravity advised)']},
'title': 'Critical Zero-Click RCE Flaw Found in Major AI Coding Agents '
'(Plugin4Shell)',
'type': 'Zero-Click Remote Code Execution (RCE)',
'vulnerability_exploited': 'Weaknesses in SHA pinning verification for '
'plugins; Git branch naming flaw (Claude Code, '
'Codex, GitHub Copilot); commit-fetching process '
'flaw (Gemini CLI)'}