Leading AI coding agents Claude Code, Codex, GitHub Copilot, and Gemini CLI were vulnerable to a zero-click remote code execution flaw that let attackers silently swap a trusted plug-in for a malicious one – no user interaction required.
The Air Security team of Or Nevo, Dor Granat, and Niv Hoffman disclosed the flaw, which they’ve named Plugin4Shell. The bug is tied to how coding agents verify plug-ins pinned to a specific, reviewed commit. Ironically, this exploits a safeguard the industry built specifically to stop this kind of rug-pull.
Two of the four agents are already fixed: Claude Code and Codex. GitHub Copilot and Gemini CLI are not, and Gemini CLI won’t be. If you’re on Claude Code or Codex, update now. If you’re on Copilot, there’s no patch yet. If you’re on Gemini CLI, Google is deprecating it entirely and won’t patch it.
Who is at Risk to Plugin4Shell?
This isn’t a risk to general users. It’s a risk to the people building and securing software, such as developers and AppSec teams running these coding agents. Hypothetically, a developer is vulnerable to attack simply by opening their poisoned coding agent. Next, the agent’s routine background update silently hands an attacker their system, which include files, credentials and privileged network access. From there, the attack chain extends outward.
A compromised coder’s credentials or machine become the attacker’s gateway to the company’s broader network handing the attacker the same internal access the developer has.
Researchers noted one caveat: the trick only works where a repo host allows a branch to be named like a hash. GitHub itself rejects that outright, so a plugin repo hosted there is protected from this specific swap. Bitbucket and self-hosted git servers allow it — and Anthropic’s own documentation lists both as supported marketplace backends. Gemini CLI’s separate attack variant, which targets a differently-named default branch rather than a hash, isn’t covered by this protection either way.
The Air Security team outlined how the attack might work.
Deconstructing the Attack
First, an attacker gets a benign, legitimately reviewed plug-in into a trusted marketplace, or takes over the repo – the code repository where a plug-in’s source lives and gets updated -behind one that’s already there. A typical plug-in might be a tool that automatically checks spelling and formatting in code, or one that writes routine documentation — small conveniences a developer installs once, forgets about, and lets run in the background.
Once a developer installs the poisoned plug-in, it’s pinned – meaning locked to one reviewed version, tracked by a unique ID called a hash. The attacker creates a branch, which is a git term for a separate copy of the code, and names it after that hash. Then they set it as the repo’s default. Think of the hash as a trusted shortcut that’s supposed to lead straight to the reviewed code – the attacker rewires it to lead to booby-trapped code instead, while it still looks like the same shortcut.
Once that plug-in is installed and running, it can reach anything the developer’s coding agent can touch, such as files, credentials, the systems they’re working in.
The agent’s background auto-update, which is on by default in Claude Code and Codex, checks out that branch instead of the pinned commit. The reason the branch is checked versus the commit is because git, by default, prefers a branch name over a commit hash when both exist. The swap happens with no install step, no prompt, and nothing for the user to notice.
The flaw is, in the researchers’ words, “zero-click remote code execution across Claude Code, Codex, GitHub Copilot, and Gemini CLI.”
The impact isn’t limited to what the agent generates going forward. The compromised plug-in inherits the same access as the developer running it, meaning full remote code execution on that machine and reach into whatever data, internal systems, or production environments that developer can touch.
The Fix
Anthropic fixed Claude Code in version 2.1.179 and OpenAI fixed Codex in 0.146.0, both after Air Security’s disclosure. Microsoft has not shipped a fix for GitHub Copilot. Google has deprecated Gemini CLI entirely and confirmed it won’t patch the flaw – anyone still on it stays exposed, and Google is telling users to migrate to Antigravity instead, which Air Security says isn’t exposed to this bug.
The name is likely a nod to Log4Shell, the 2021 Log4j vulnerability that became shorthand for “zero-click RCE bug severe enough to matter to everyone, not just security teams.” Swapping “Log4j” for “Plugin” signals the same category of flaw where a small, ubiquitous, trusted component turned into remote code execution with no user action required.
Air Security said it found the flaw in May 2026 and disclosed it to all four vendors that June under coordinated disclosure.
A Familiar Playbook
Plugin4Shell isn’t an isolated find. It’s the third piece of research from this same team. It also developed a fake skill that passed security review and reached roughly 26,000 agents by swapping its payload after the fact. A second report, called SkillJacking, found 925 already-installed skills sitting on hijackable sources like abandoned GitHub accounts and expired domains. Researchers took over one with 11,483 installs just by re-registering its deleted owner’s username.
Each of the Air Security reports targets a different weakness in how AI agents decide what to trust: the review process, the maintainer’s identity, and now the version-pinning mechanism itself.
Similar research also highlights this growing attack vector. Phoenix Security’s tracking counted 6 open-source supply-chain campaigns in 2024. By mid-July 2026 that number had grown to 52, with 56 of 106 tracked campaigns touching AI, LLM, or agent tooling specifically. A separate scan by security firm Sigil of more than 39,000 AI agent packages across PyPI, npm, and GitHub found 4.2% contained malicious patterns.
Cisco’s 2026 State of AI Security survey found only 29% of organizations feel prepared to secure agentic AI, and just 18% are highly confident their identity systems can handle non-human agent identities at all. That is the exact gap Plugin4Shell exploits, since a compromised plugin simply inherits whatever access the developer already has.
Image Credit: Photo by Jackson Sophat on Unsplash
