Plugin4Shell Bug Hit AI Coding Agents

The trust that wasn't checked

Imagine hiring a contractor, verifying their ID at the door, then letting a stranger walk in and do the work anyway. That is roughly what happened to some of the most popular AI coding agents, according to researchers at cybersecurity startup AIR.

They found a zero-click flaw, meaning an attack that runs without any action from the developer, affecting OpenAI's Codex, Anthropic's Claude Code, Google's Gemini CLI, and Microsoft-owned GitHub Copilot. They named it Plugin4Shell. First discovered in May and disclosed to vendors in June, it let attackers run malicious code inside enterprise development environments by quietly swapping a trusted plugin for a poisoned one.

What actually went wrong

Enterprises use plugins to extend what an AI coding agent can do, giving it extra tools, commands, and services. When a developer installs one, the agent downloads the code from a Git repository and confirms it is the approved version using a SHA. That is a secure hash algorithm, a unique cryptographic fingerprint assigned to each Git commit. Tell the agent the SHA of the reviewed commit, and it should run exactly that code.

Here is the gap. Codex, Claude Code, and Copilot pass the SHA to Git to check out the plugin, but they never confirm afterward that Git actually returned the commit matching that SHA. An attacker who controls the plugin's repository, either by publishing a harmless plugin and later turning it malicious, or by hijacking the repo behind an existing trusted one, can create a new version and name it after the legitimate SHA. When the agent asks for that SHA, Git hands over the attacker's version instead.

Gemini CLI fell to the same underlying problem through a different door. It uses the SHA to fetch the plugin, then checks out the code under the name "FETCH_HEAD." An attacker can create a malicious version with that same name, so Git returns the wrong code. In both cases, the root issue is identical. The agent trusts what it asked for without verifying what it got.

Why this matters

Plugins usually run with the same access as the developer or employee who installed them. That is the uncomfortable part. As Pareekh Jain, principal analyst at Pareekh Consulting, put it, enterprises whose agents can reach source code, credentials, cloud systems, or CI/CD pipelines are the most exposed. CI/CD refers to the automated pipelines that build, test, and ship software.

In practice, a compromised plugin could steal API keys or cloud credentials, alter repositories, or reach further into corporate systems. The researchers were blunt about the scope: this is "a flaw no marketplace can fix, so users must update their agent."

Who has patched, and who hasn't

The response has been uneven. Anthropic fixed Claude Code in version 2.1.179, and OpenAI addressed Codex in version 0.146.0. Google said it has deprecated Gemini CLI and will not issue a fix, pointing users to a replacement called Antigravity instead.

GitHub has not released a Copilot fix. A GitHub representative told The Register that it already blocks the creation of version or tag names resembling commit SHAs, which prevents exploitation on GitHub itself. AIR researchers counter that this may not be enough, since plugin marketplaces can also live on other platforms such as Bitbucket.

For security teams, Jain suggests examining machines running these agents for warning signs: unusual processes or network connections, unexpected plugin files, changed repositories, suspicious Git activity, and odd use of developer or cloud credentials. He points to logs from EDR, which stands for endpoint detection and response, along with Git, CI/CD, cloud IAM, and authentication systems as good starting points, and advises checking whether agents auto-update so patches actually land.

What's next

Those steps reduce risk but do not close the hole. As Jain notes, the real fix is a vendor responsibility, because the flaw lives in how agents verify the code they are told to run. Enterprises can wrap controls around plugin usage, but they cannot patch the validation logic themselves. The broader lesson is worth holding onto: as AI agents gain the power to fetch and execute code on our behalf, checking that they run what we approved becomes just as important as approving it in the first place.