Zero Click Flaw in Four AI Coding Agents Leaves Copilot and Gemini CLI Exposed
A single design flaw, dubbed Plugin4Shell, affects the plugin systems of four of the most widely deployed AI coding agents: Anthropic's Claude Code, OpenAI's Codex, GitHub Copilot and Google's Gemini CLI. The issue defeats SHA pinning, the mechanism that is supposed to lock an installed plugin to one specific, reviewed commit of its source code so that it cannot silently change afterwards. Successful abuse gives an attacker remote code execution on the developer's machine with exactly the reach the employee running the agent has, across company systems and data. No CVE identifiers have been assigned in the available reporting. The exposure is not limited to careless users: a victim only needs to have a plugin installed from a marketplace they trust, reviewed and pinned exactly as the security model intends.
All four agents check out the pinned commit but never verify that the checkout actually landed on it, which allows an attacker to swap in different code while the pin still looks intact. Claude Code, Codex and Copilot share one variant of the bypass, rooted in how git resolves branch names, and the trick only works where a branch can be named to look like a commit hash. That is git's default behaviour, and while GitHub rejects a 40 hex character branch name outright, Bitbucket and self hosted git servers permit it. Gemini CLI is reachable through a separate weakness in how it fetches and checks out pinned commits, with the same end result. The zero click element comes from the fact that the same git checkout re runs during background auto update, which is the default in Claude Code and Codex, so when a marketplace bumps the pinned SHA the swapped code reaches already installed plugins with no user action at all. Two routes into the ecosystem were demonstrated: publishing a legitimate plugin that is only turned malicious after adoption, and taking over the repository behind a plugin that other people wrote and users already trust.
The strategic weight here sits in the delivery half of the chain, which has already been shown to work at scale. Earlier research by the same team produced a plugin that spread to more than 26,000 agents before it was pulled, and separate work on skill repository hijacking identified 925 skills in active use that had been taken over from their original maintainers, reaching 134,000 agents. Plugin4Shell removes the one control designed to contain exactly that scenario, so a takeover that would previously have stopped at the pin now propagates to every existing install. Because the flawed check runs inside the agent rather than at the marketplace, no marketplace can close the gap on behalf of its users, and the fix has to come from each vendor. The response has been uneven: the flaw was found in May 2026 with working proof of concept exploits against all four agents and disclosed to the vendors the following month, after which Anthropic shipped a fix in Claude Code 2.1.179 and OpenAI shipped one in Codex 0.146.0. Microsoft has not released a fix for Copilot, leaving those users with no patch, and Google has deprecated Gemini CLI rather than patching it, which means every existing install stays exposed indefinitely with the vendor pointing users towards its newer Antigravity agent, built without the pinning system this attack relies on. The proof of concept code is held by the researchers rather than published, and there is no confirmed in the wild exploitation of Plugin4Shell itself at the time of writing, but developer workstations running coding agents typically hold source code, cloud credentials, SSH keys and production access, which makes them a high value landing point for a supply chain attack that requires nothing from the victim.
Attack Surface
Supply Chain (Third-party vendors), Endpoint
Tactics
Initial Access, Execution, Persistence, Resource Development, Defense Evasion
Techniques
- T1195.002 – Supply Chain Compromise: Compromise Software Supply Chain
- T1059 – Command and Scripting Interpreter
- T1072 – Software Deployment Tools
- T1584 – Compromise Infrastructure
- T1554 – Compromise Host Software Binary
SuperPRO's Threat Countermeasures Procedures
- Upgrade Claude Code to version 2.1.179 or later on every developer workstation and build agent; Anthropic shipped the SHA pinning fix in that release following disclosure.
- Upgrade Codex to version 0.146.0 or later; OpenAI patched the same pinning bypass in that build, and earlier versions re run the flawed git checkout on background auto update.
- Treat all GitHub Copilot installs as unpatched, since Microsoft has not shipped a fix. Inventory installed Copilot plugins and remove any whose source repository is hosted on Bitbucket or a self hosted git server, as those hosts allow the 40 hex character branch names the bypass depends on; GitHub hosted repositories reject such branch names outright.
- Treat all Gemini CLI installs as permanently exposed, as Google deprecated the product instead of patching it. Google's stated path for those users is migration to its Antigravity agent, which is built without the plugin pinning system this attack abuses.
- Where an upgrade cannot be completed immediately, disable background plugin auto update in Claude Code and Codex, since auto update is the default and is what makes the attack zero click for already installed plugins.
- Add a verification step in CI and on managed developer images that runs git rev-parse HEAD after any plugin checkout and fails the job when the resulting commit hash does not match the pinned SHA; also alert on any plugin repository containing a branch or ref whose name is 40 hexadecimal characters.
- Audit installed plugins and agent skills for maintainer or repository ownership changes, the takeover route that hijacked 925 in use skills across 134,000 agents, and alert on agent processes spawning shells or making unexpected outbound connections immediately after a plugin update.
