Plugin4Shell: The Zero-Click Plugin Update Flaw in AI Coding Agents

Plugin4Shell is the name Air Security gave to a reported high-severity, zero-click remote-code-execution vulnerability in plugin handling by major AI coding agents. It is a software supply-chain issue rather than a flaw in an underlying language model: an attacker can turn a plugin a developer already trusts into a route to run malicious code on that developer’s machine. 23

How the SHA-pinning bypass works

Plugin marketplaces commonly identify a plugin revision with a Git commit SHA. In principle, pinning to a specific commit should make the expected code immutable: the agent should retrieve that precise revision and verify that the result matches the expected SHA.

Air’s report says the affected pattern broke down after checkout. The agent checked out the commit specified by the marketplace but did not verify that the files actually obtained corresponded to that pinned commit. An attacker able to control the plugin repository could cause the checkout to resolve to malicious code while the agent still treated the plugin as pinned and trusted. 2

That distinction matters. A hash is useful only when the application independently checks the artifact it received against the immutable value it intended to fetch. Merely carrying a pin in marketplace metadata does not protect the user if the post-checkout verification step is missing.

Why the attack is described as “zero click”

The developer does not need to approve a new installation at the time of compromise. Once a legitimate plugin is already installed, an automatic update can retrieve and execute the attacker-controlled replacement without a new prompt, click, or reinstall. 26

The initial foothold is therefore upstream of the developer: control of a trusted plugin repository or related publishing path. This is why the incident is best understood as a supply-chain risk, not as a case of a user deliberately installing an obviously unsafe extension.

What an attacker could reach after code execution

Remote code execution in a development environment can grant the attacker the same effective reach as the user and agent process. According to reporting on the disclosure, that can include company systems and data accessible to the employee running the agent. 34

In practice, the exposure can include local source files, repositories, build tooling, environment variables, and credentials available to the developer session. If those credentials permit access to cloud accounts, source-control services, CI/CD systems, or connected tools, a compromised workstation can become a stepping stone to broader organizational access. This impact depends on the privileges and secrets actually exposed to the agent and user account. 34

Reported vendor status

Air reported Plugin4Shell across Claude Code, OpenAI Codex, Copilot, and Gemini CLI. 2

• Anthropic Claude Code: Air and subsequent reporting identified Claude Code 2.1.179 as containing a fix. 12
• OpenAI Codex: Codex 0.146.0 was reported as containing a fix. 12
• Google Gemini CLI: reporting described the affected Gemini CLI path as deprecated and said Google would not fix that legacy path; users should move away from it rather than wait for a patch. 13
• Microsoft and GitHub Copilot: Air included Copilot in its affected-agent claim, while public descriptions of the issue have not presented a single uncontested remediation conclusion. Organizations should assess the exact Copilot product, extension channel, update configuration, and centrally enforced controls in use rather than assume that a claim about one path applies to every deployment. 234

Because this is a fast-moving disclosure and vendor status can change, teams should verify the version and advisories for the specific agent they operate before treating any installation as remediated.

How to reduce the risk

Updating to a version reported as fixed is the first step. The wider lesson is to treat plugins for coding agents as executable third-party software with access to a privileged development environment.

Recommended controls include:

• Restrict automatic plugin and extension updates. Require review for changes to code that an agent will install or execute.
• Allowlist only needed plugins, publishers, and immutable versions. Minimize the number of supply-chain relationships the development environment trusts.
• Verify the artifact after retrieval. Enforce a check that the code on disk matches the approved, pinned commit or artifact identity; abort if it does not. 28
• Use stronger provenance controls. Approval policy should bind a trusted publisher and immutable artifact or version, rather than relying only on mutable update-channel behavior.
• Apply least privilege. Do not give an agent process broad production access or long-lived credentials unless necessary. Isolate or sandbox agent execution where feasible.
• Review secrets exposure. If an affected agent or plugin may have executed on a developer endpoint, rotate relevant credentials and investigate access logs. The potential blast radius follows the access available to that endpoint. 34

Why Plugin4Shell matters beyond one bug

Plugin4Shell shows how AI-agent deployments can amplify familiar security problems. Coding agents increasingly retrieve plugins and operate alongside repositories, cloud tooling, tokens, and deployment workflows. A compromise in an update path can therefore become a route to credential theft or source-code and infrastructure access. 34

It also complements, rather than replaces, concerns about prompt injection. A malicious repository, issue, document, or tool output may try to persuade an agent to take an unsafe action. Plugin4Shell is different: the reported update-path weakness could execute malicious code without waiting for a fresh instruction or user approval. Both risks become more serious when agents can use tools and hold meaningful permissions.

The security takeaway is straightforward: manage an AI coding agent as a privileged automation endpoint. Update it promptly, constrain what it can install and access, and verify the exact code that enters the developer environment.