Security researchers disclosed a zero-click remote-code-execution flaw, dubbed Plugin4Shell, affecting the plugin-installation logic shared by four major AI coding agents: Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI. Researchers describe it as the first supply-chain vulnerability found across the AI coding agent ecosystem, giving an attacker who exploits it the same system and data access as the developer running the agent.
The flaw lies in how these tools handle SHA-pinned plugin versions: marketplaces pin a plugin to a specific Git commit hash after review, but for Claude Code, Codex and Copilot, an attacker can create a branch whose name matches that 40-character commit hash, and Git may check out the attacker-controlled branch instead of the reviewed commit. Gemini CLI has a related variant that abuses a branch named FETCH_HEAD to redirect the checkout. Anthropic patched Claude Code in version 2.1.179 and OpenAI fixed Codex in version 0.146.0. Microsoft has not yet shipped a fix for Copilot, and Google chose to deprecate Gemini CLI rather than patch it, leaving existing installs exposed indefinitely.
Why it matters
AI coding agents now run with broad repository and system access inside many development pipelines; a shared flaw in how four of the most widely used agents install plugins means a single exploitation technique can reach into a large share of the software supply chain that depends on them.
Leave a Reply