Plugin4Shell – Zero Click RCE Vulnerability found in top four coding agents BackPlugin4Shell - Zero Click RCE Vulnerability found in top 4 most popular coding agents, millions of agents affectedPlugi
By Coderz Club · 2026-09-18 · Tags: coding, ai
.png)
Plugin4Shell – Zero Click RCE Vulnerability found in top four coding agents
BackPlugin4Shell - Zero Click RCE Vulnerability found in top 4 most popular coding agents, millions of agents affectedPlugin4Shell is a zero-click, high-severity RCE affecting all four major AI coding agents - Claude Code, Codex, Copilot, and Gemini. In this first-of-its-kind AI supply-chain attack, a trusted plugin is silently swapped for a malicious one and auto-installed past the agent's SHA pinning - a flaw no marketplace can fix, so users must update their agent.Or Nevo,Dor Granat,Niv HoffmanSeptember 17, 2026ShareCopied to ClipboardAgent add-ons - the plugins and skills you install into an AI agent - are effectively applications, and enterprises overwhelmingly install them from open community marketplaces rather than a vetted, enterprise-grade one. The agent runs with the full capabilities of the employee operating it: the same access to sensitive data, internal systems, and production environments. Plugins inherit those permissions by default. A malicious plugin therefore does not need to escalate anything: it achieves full remote code execution on the employee's machine and hands an attacker the same reach over the enterprise's crown jewels that the employee has.The story so farThis is the third act of a story we have been telling. In The Story of Skills we showed how easy it is to get in: we built a malicious skill, watched it go viral, and seized control of over 26,000 agents - planting your code in a marketplace people trust is not the hard part. In SkillJacking we showed you don't even need to plant anything: 925 skills already in use were hijacked out from under their maintainers, affecting 134,000 agents, by taking over the repositories behind them. The industry's answer to exactly this kind of rug-pull is SHA pinning - review the code at one commit, pin that commit, and trust that the pinned commit is what runs forever after. Plugin4Shell is the story of that boundary failing.It is a plugin SHA-pinning bypass: the agent checks out the exact commit the marketplace pinned but never verifies it landed there, so an attacker who controls the plugin's repo makes the checkout resolve to malicious code while the pin still looks honored. The result is zero-click remote code execution across Claude Code, Codex, GitHub Copilot, and Gemini CLI.Enterprises using Air Marketplace and Air Filter were not affected by Plugin4Shell.Why Plugin4Shell is uniqueIt is the first supply chain vulnerability of the AI agent ecosystem. Previous agent security work has targeted the model or the agent itself. Plugin4Shell attacks the distribution layer underneath them, the marketplaces through which agent add-ons reach millions of machines.Zero-click remote code execution. No user interaction of any kind is required. The result is full compromise of the agent and the host it runs on, and with it full access to every asset and every piece of data the agent can reach.One flaw, and every major lab made it. The same design error sits in every affected agent - not an implementation slip in one product, but a single mistake repeated across the industry, leaving millions of agents vulnerable.A marketplace cannot fully close this. The pin is resolved inside the agent, so only an agent-side fix restores the guarantee. A marketplace can blunt the branch-name variant by allowing only hosts that reject SHA-shaped names - effectively, GitHub-only - but that bans hosts the agents officially support, and does nothing for Gemini CLI's variant.Who is affected and what is the impactAnyone running a major coding agent that installs plugins from a marketplace is exposed. That is Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI. The exposure is not limited to users who install plugins carelessly: the victim only has to have a plugin installed, from a marketplace they trust, that was reviewed and pinned exactly as the security model intends.Doing the right thing does not protect you. Organizations that go beyond a community marketplace - reviewing plugins and pinning them to a reviewed commit - rely on SHA pinning as their safeguard, and Plugin4Shell quietly nullifies it: review passes, the pin is written, and different code installs. Every downstream vetting process built on pinning inherits the failure.What makes it 0-click is plugin auto-update. Agents update installed plugins in the background - in Claude Code and Codex this is the default - so when the pinned commit is swapped upstream, a plugin the user already trusts and already has installed is replaced with a malicious version without any user interaction: no install step, no prompt, nothing to notice. The attacker does not need to persuade anyone to install anything new. They only need the benign plugin to already be there.How it can be exploitedThere are two paths, and neither requires the attacker to control the marketplace.Method 1: publish a plugin, then turn it malicious. The attacker contribute
BackPlugin4Shell - Zero Click RCE Vulnerability found in top 4 most popular coding agents, millions of agents affectedPlugin4Shell is a zero-click, high-severity RCE affecting all four major AI coding agents - Claude Code, Codex, Copilot, and Gemini. In this first-of-its-kind AI supply-chain attack, a trusted plugin is silently swapped for a malicious one and auto-installed past the agent's SHA pinning - a flaw no marketplace can fix, so users must update their agent.Or Nevo,Dor Granat,Niv HoffmanSeptember 17, 2026ShareCopied to ClipboardAgent add-ons - the plugins and skills you install into an AI agent - are effectively applications, and enterprises overwhelmingly install them from open community marketplaces rather than a vetted, enterprise-grade one. The agent runs with the full capabilities of the employee operating it: the same access to sensitive data, internal systems, and production environments. Plugins inherit those permissions by default. A malicious plugin therefore does not need to escalate anything: it achieves full remote code execution on the employee's machine and hands an attacker the same reach over the enterprise's crown jewels that the employee has.The story so farThis is the third act of a story we have been telling. In The Story of Skills we showed how easy it is to get in: we built a malicious skill, watched it go viral, and seized control of over 26,000 agents - planting your code in a marketplace people trust is not the hard part. In SkillJacking we showed you don't even need to plant anything: 925 skills already in use were hijacked out from under their maintainers, affecting 134,000 agents, by taking over the repositories behind them. The industry's answer to exactly this kind of rug-pull is SHA pinning - review the code at one commit, pin that commit, and trust that the pinned commit is what runs forever after. Plugin4Shell is the story of that boundary failing.It is a plugin SHA-pinning bypass: the agent checks out the exact commit the marketplace pinned but never verifies it landed there, so an attacker who controls the plugin's repo makes the checkout resolve to malicious code while the pin still looks honored. The result is zero-click remote code execution across Claude Code, Codex, GitHub Copilot, and Gemini CLI.Enterprises using Air Marketplace and Air Filter were not affected by Plugin4Shell.Why Plugin4Shell is uniqueIt is the first supply chain vulnerability of the AI agent ecosystem. Previous agent security work has targeted the model or the agent itself. Plugin4Shell attacks the distribution layer underneath them, the marketplaces through which agent add-ons reach millions of machines.Zero-click remote code execution. No user interaction of any kind is required. The result is full compromise of the agent and the host it runs on, and with it full access to every asset and every piece of data the agent can reach.One flaw, and every major lab made it. The same design error sits in every affected agent - not an implementation slip in one product, but a single mistake repeated across the industry, leaving millions of agents vulnerable.A marketplace cannot fully close this. The pin is resolved inside the agent, so only an agent-side fix restores the guarantee. A marketplace can blunt the branch-name variant by allowing only hosts that reject SHA-shaped names - effectively, GitHub-only - but that bans hosts the agents officially support, and does nothing for Gemini CLI's variant.Who is affected and what is the impactAnyone running a major coding agent that installs plugins from a marketplace is exposed. That is Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI. The exposure is not limited to users who install plugins carelessly: the victim only has to have a plugin installed, from a marketplace they trust, that was reviewed and pinned exactly as the security model intends.Doing the right thing does not protect you. Organizations that go beyond a community marketplace - reviewing plugins and pinning them to a reviewed commit - rely on SHA pinning as their safeguard, and Plugin4Shell quietly nullifies it: review passes, the pin is written, and different code installs. Every downstream vetting process built on pinning inherits the failure.What makes it 0-click is plugin auto-update. Agents update installed plugins in the background - in Claude Code and Codex this is the default - so when the pinned commit is swapped upstream, a plugin the user already trusts and already has installed is replaced with a malicious version without any user interaction: no install step, no prompt, nothing to notice. The attacker does not need to persuade anyone to install anything new. They only need the benign plugin to already be there.How it can be exploitedThere are two paths, and neither requires the attacker to control the marketplace.Method 1: publish a plugin, then turn it malicious. The attacker contribute