Plugin4Shell: The Zero-Click Bug Hitting Claude Code, Codex, Copilot and Gemini CLI

What is Plugin4Shell?

Plugin4Shell is a supply-chain flaw in how AI coding agents install plugins, not a flaw in the AI models themselves. It was disclosed publicly on 17 September 2026 by AIR Security researchers Or Nevo, Dor Granat and Niv Hoffman, who say they found it in May 2026 and reported it to affected vendors the following month.

The important thing to understand up front: no breach, incident or data loss has been reported. This is a disclosed vulnerability with working proof-of-concept exploits demonstrated by researchers, not an attack that happened.

How does the attack work?

Modern coding agents install plugins, skills and extensions from marketplaces. To keep that safe, a marketplace reviews a plugin and then pins it to a specific Git commit hash — a 40-character string identifying an exact snapshot of code. The promise of pinning is that once a version is reviewed, it cannot silently change.

AIR found that the affected agents fetch the pinned commit but never verify that the code they actually ended up with matches it.

For Claude Code, Codex and GitHub Copilot, the researchers showed that someone controlling a plugin's repository could create a branch whose name is identical to the pinned 40-character hash, and set it as the repository's default branch. During checkout, Git resolves the branch name ahead of the commit object. The agent reports a clean install at the expected hash while running whatever code sits on that branch instead.

Gemini CLI reaches the same outcome by a different route. Its plugin process fetches the intended commit and then checks out FETCH_HEAD. A repository whose default branch is named FETCH_HEAD redirects that checkout to the branch rather than the fetched commit.

Why is it "zero-click"?

Because plugin updates are automatic. Claude Code and Codex can refresh plugins from their built-in marketplaces, so an already-installed plugin can receive changed upstream content without any new installation prompt or approval. The victim does not have to click, approve or reinstall anything.

This is also why "just be careful what you install" is not a defence. The exposure applies to a developer who installed a plugin from a marketplace they trust, that was reviewed and pinned exactly as the security model intends. Doing the right thing does not protect you.

What is the actual risk?

Agent plugins generally run with the permissions of the developer running the agent. In practice that can include local source code, cloud credentials, SSH keys, internal repositories, internal services, production systems and secrets. A compromised plugin does not need to break into anything — it already runs as the developer.

GitHub has put Copilot usage at roughly 90% of the Fortune 100, which is why the unpatched status of that client drew the most attention.

Patch status

Verify current status before acting on this table — it reflects the position at disclosure and vendors may have shipped fixes since.

Is there a mitigation at the marketplace level?

Only partially, and this is the point the researchers and GitHub disagree on.

A GitHub spokesperson stated that GitHub does not allow users to create branch or tag names resembling commit SHAs, which blocks the hash-shaped branch variant on that host. AIR disputes the scope of that mitigation, noting the FETCH_HEAD variant does not use a hash-shaped name and is not clearly covered by the rule.

More fundamentally: because the missing verification happens inside the agent rather than at the marketplace, AIR argues no marketplace can guarantee the protection on its own. Closing the gap requires each vendor to fix it in the client. Updating remains the only complete fix where one exists.

What should you do right now?

1. Check your agent versions and update. For Claude Code, you need 2.1.179 or later; for Codex, 0.146.0 or later.
2. Inventory installed plugins. Know what is installed, from which repositories, and who controls those repositories.
3. Treat repository ownership as part of your trust chain after installation, not just before it. A plugin's owner can change; the pin does not protect you if the ownership does.
4. Restrict plugin sources to vetted hosts.
5. Review default branch settings on any agent extension repositories you own.
6. Assume the developer's full local privilege set is the blast radius, and reduce it. Agents should not be running with standing production credentials.

The wider lesson

Four independent teams at four companies shipped the same missing check. That is not four coincidences — it is a shared assumption that pinning a commit and checking out a commit are the same operation. They are not.

As agent plugin ecosystems grow, this category of flaw — trusted by the model's supply chain rather than by the model — is likely to keep producing findings. The security surface of an AI coding agent is not mainly the model. It is everything the agent is permitted to run.

DISCLOSURE: dontbeac.app is built using AI coding agents, including tools affected by this disclosure. The author verified the patched version numbers above against the vendors' own release notes on 21 Sep 2026.