Zero-Click RCE Vulnerability 'Plugin4Shell' Discovered in Four Major AI Coding Agents

The Air Security research team disclosed 'Plugin4Shell', a zero-click remote code execution (RCE) vulnerability commonly found in four major AI coding agents: Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI. This is the first reported supply chain vulnerability in the AI coding agent ecosystem, potentially endangering millions of agents and host systems.

Vulnerability Mechanism

The vulnerability exploits a design flaw where, even if an agent pins a plugin to a specific commit hash (SHA) during installation, it does not verify whether the actually checked-out code matches that pinned commit. Attackers can compromise a repository or create a malicious branch to exploit git's reference precedence characteristics (where branches take precedence over commits). This allows malicious code to execute without user interaction, exposing all data and systems accessible with the agent's permissions.

Impact and Response Status

The vulnerability is particularly critical in agents where automatic updates are enabled by default. The response status by vendor is as follows:

• Claude Code: Fixed in version 2.1.179
• OpenAI Codex: Fixed in version 0.146.0
• GitHub Copilot: Currently unpatched
• Gemini CLI: Unable to patch due to discontinuation of support; migration to Antigravity is recommended

The research team emphasized that blocking at the marketplace level alone is insufficient, and a patch on the agent side to verify whether the checked-out code matches the pinned SHA using git rev-parse HEAD is essential. They also warned of severe supply chain security risks in the AI agent ecosystem, citing the 'MCPjacking' case where 155 hijackable MCPs using expired domains were discovered in the official MCP marketplace.