'Plugin4Shell' flaw hits major AI coding agents

Security researchers at the AI security startup Air disclosed a zero-click remote code execution flaw on 17 September 2026 that they say affects all of the major AI coding agents: Anthropic's Claude Code, OpenAI's Codex, Google's Gemini CLI, Microsoft's Copilot and Microsoft-owned GitHub Copilot. The researchers, named in their report as Or Nevo, Dor Granat and Niv Hoffman, said the bug could give attackers full access to every asset and piece of data an affected agent can reach.

The researchers call the flaw "Plugin4Shell" and describe it as a "first-of-its-kind AI supply-chain attack". Rather than attacking the model or the agent directly, it targets the trusted marketplaces that distribute plugins and skills to coding agents. Because those marketplaces serve so many installs, the researchers said such an attack could reach millions of users and machines. Microsoft says almost 90 per cent of Fortune 500 companies use Copilot.

The technical problem lies in how agents enforce SHA-pinning, a mechanism that locks a plugin to a specific, immutable commit hash instead of a movable reference such as a branch name or version tag. Pinning is meant to stop supply chain attacks: if a public skill repository is compromised, the agent should keep running the same audited code it was pinned to. According to the Air report, the agent checks out the exact commit the marketplace pinned "but never verifies it landed there", so an attacker who controls the plugin repository can make the checkout resolve to malicious code while the pin still appears to be honoured.

The attack needs no user action because Claude Code and Codex both auto-update installed plugins by default, the researchers said. Once a pinned commit is swapped upstream, the installed plugin is silently replaced. Air outlined two routes in: submitting a benign plugin to a trusted marketplace, passing review, then swapping in malicious content later; or hijacking a legitimate author's repository and pushing a malicious version to every agent that has the plugin installed. The team says it demonstrated repository takeover in earlier work it calls SkillJacking and RepoJacking.

Air reported the issue to all four vendors in June. Anthropic patched it in Claude Code 2.1.179 and OpenAI in Codex 0.146.0. Google has deprecated the Gemini CLI and told Air it will not patch, so every install remains vulnerable; the company suggests users move to its newer Antigravity agentic development environment, which the researchers say is protected. Microsoft did not fix the flaw in Copilot and did not immediately respond to The Register's request for comment. Air said it received no response from Microsoft, which the researchers attributed to the volume of disclosures the company is handling.

A GitHub spokesperson told The Register that Plugin4Shell does not affect GitHub, because GitHub does not allow users to create branch or tag names that resemble commit SHAs. Air disputes that this is enough, telling The Register that marketplaces can be hosted on other platforms such as Bitbucket, and that Microsoft Copilot supports those platforms too.

The researchers said the only complete mitigation, where one exists, is updating the agent itself.