A zero-click vulnerability that enables remote code execution affects every major AI coding assistant, including Anthropic's Claude Code, OpenAI's Codex, Google's Gemini CLI, Microsoft's Copilot, and GitHub Copilot, and could grant attackers complete access to all assets and data the agent can reach, according to threat researchers at Air, a security startup focused on protecting enterprise AI agents. The exploit, called "Plugin4Shell," represents what Air describes as "a first-of-its-kind AI supply-chain attack." Instead of attacking the model or agent directly, Plugin4Shell targets trusted marketplaces that host plugins for major coding agents, potentially reaching millions of users and machines.
Air's research team reported the security flaw to all four vendors in June. Both Anthropic and OpenAI shipped patches in Claude Code 2.1.179 and Codex 0.146.0, respectively. Google deprecated the Gemini CLI and told Air it won't issue a fix, leaving every installation exposed, though the company recommends users migrate to its newer Antigravity agentic development environment, which is protected from this attack. Microsoft didn't patch the vulnerability in Copilot. A GitHub spokesperson said Plugin4Shell attacks don't affect GitHub because "GitHub does not allow users to create branch or tag names that resemble commit SHAs." However, Air researchers told The Register this mitigation isn't sufficient "because marketplaces can also be hosted in other platforms such as Bitbucket," and Microsoft Copilot remains vulnerable since it supports marketplaces from such platforms. Almost 90 percent of Fortune 500 companies use Copilot, according to Microsoft.
The vulnerability exists in how agents enforce marketplaces' SHA-pinning mechanism, which locks agent plugins and skills to a specific, immutable commit hash rather than a mutable reference like a version tag or branch name. This aims to prevent supply chain attacks: if a public skill repository is compromised, your AI agent will continue running the same, audited code hash it used when you pinned it instead of automatically pulling new, malicious payloads. Air researchers Or Nevo, Dor Granat, and Niv Hoffman describe the flaw as "a plugin SHA-pinning bypass." The agent checks out the exact commit the marketplace pinned but never verifies it landed there, so an attacker who controls the plugin's repository makes the checkout resolve to malicious code while the pin still appears honored. "The result is zero-click remote code execution," the researchers wrote.
The report outlines two attack scenarios. In the first, an attacker submits a benign plugin to a trusted marketplace, the plugin passes review, and then the attacker later replaces the benign content with malicious code. The second attack involves hijacking a legitimate author's repository and then pushing the malicious version onto every agent that has it installed, essentially bypassing the SHA pinning safety mechanism that exists to stop this type of supply chain attack. Agents' plugin auto-update feature makes this a zero-click attack: when a pinned commit is swapped upstream, the agent's plugin gets replaced with a malicious version, and both Claude and Codex automatically update installed plugins by default. The team demonstrates this type of takeover in their earlier SkillJacking and RepoJacking proof-of-concept attacks. "Together, the chain is proven end to end," the researchers wrote, "takeovers happen at scale, and Plugin4Shell defeats the mechanism built to contain them." The only complete mitigation where one exists is updating the agent itself, the Air team said. The gap between disclosure and patching across major vendors highlights how enterprise reliance on AI tooling can outpace the security infrastructure needed to support it. Organizations building mission-critical workflows around these agents may need to reconsider which platforms offer the most accountable response to supply chain threats.