Plugin4Shell Lets Repository Owners Swap Pinned Plugin Code Across Four AI Coding Agents

Severity
Medium

Detail

Security researchers have disclosed a zero-click remote code execution (RCE) vulnerability, dubbed Plugin4Shell, affecting four major AI coding agents: Anthropic Claude Code, OpenAI Codex, GitHub Copilot, and Google Gemini CLI.

The vulnerability affects the way these AI coding agents verify plugins obtained from online repositories. Attackers who control a plugin’s source repository can potentially replace trusted plugin code with malicious code while bypassing the SHA commit-pinning mechanism intended to ensure that only an approved version is installed.

The issue is particularly significant because AI coding-agent plugins can operate with the same permissions as the user running the agent, potentially providing access to local files, source code, credentials, cloud resources, and internal systems.

How?

Plugin marketplaces commonly pin plugins to a specific Git commit to ensure that the reviewed version is installed. Plugin4Shell abuses the Git checkout process because affected agents do not sufficiently verify that the code ultimately checked out corresponds to the intended commit.

An attacker controlling the plugin repository can create a branch or reference using the same name as the pinned commit SHA and point it to malicious code. When the AI coding agent performs the checkout, Git can resolve the requested SHA as the attacker-controlled reference, causing the agent to execute a different version of the plugin while still treating it as the trusted pinned version.

The attack can become zero-click when automatic plugin updates are enabled. A previously trusted plugin can be silently replaced with malicious code during an automatic update without requiring the victim to install a new plugin or approve the change.

Successful exploitation could allow malicious plugin code to execute with the privileges of the AI coding agent and potentially access source code, local files, SSH keys, credentials, cloud tokens, and other systems available to the developer. This could result in unauthorized access to development environments and enterprise resources.

Claude Code was fixed in version 2.1.179, while OpenAI Codex was fixed in version 0.146.0. GitHub Copilot remains without a corresponding agent-side fix, according to the researchers. Google has deprecated Gemini CLI and stated that it will not receive a fix; users have been advised to migrate to Google’s newer Antigravity environment.

Recommendation

Organizations should implement a layered security approach to reduce the risk of Plugin4Shell exploitation:

Upgrade Claude Code to version 2.1.179 or later and Codex to version 0.146.0 or later.
Review installed AI coding-agent plugins and remove unnecessary or untrusted plugins.
Disable automatic plugin updates where operationally possible until affected agents are confirmed secure.
Restrict AI coding agents from accessing sensitive credentials, production systems, and unnecessary files.
Monitor AI coding-agent processes for unexpected file access, credential access, network connections, and plugin changes.
Migrate from the deprecated Gemini CLI to a supported alternative.
For GitHub Copilot, apply Microsoft’s security updates when available and restrict plugin usage to trusted repositories.

Conclusion

Plugin4Shell demonstrates a significant supply-chain risk within AI coding-agent ecosystems, where malicious repository changes can bypass the commit-pinning mechanism designed to protect users from untrusted plugin updates.

Organizations using AI coding agents should prioritize updating affected products, reviewing installed plugins, restricting agent permissions, and controlling automatic plugin updates to reduce the risk of malicious code executing within trusted development environments.

Source

https://thehackernews.com/2026/09/plugin4shell-lets-repository-owners.html