Four coding agents affected by Plugin4Shell remote code execution vulnerability

The coding agents Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI are affected by a zero-click remote code execution vulnerability named Plugin4Shell. This security flaw allows malicious code to be executed on the computers of developers through manipulated marketplace plugins that the agents automatically reload.

The AI security firm AIR states that the providers of the coding agents are primarily responsible for resolving the issue because marketplaces have no control over how the agents handle downloaded code. Anthropic and OpenAI have already released patches for their respective agents. However, no fix is currently available for GitHub Copilot, and the consumer version of Gemini CLI remains permanently vulnerable. No confirmed case of the vulnerability being actively exploited has been reported.

The infected plugins appear secure on the surface because the coding agent requests a SHA fingerprint for the verified commit object stored by the marketplace. This 40-character SHA value is intended to guarantee that only that specific verified version is installed, regardless of later changes in the provider's repository. However, no agent verifies after the download whether the SHA hash of the downloaded code matches this fingerprint. The Plugin4Shell method exploits this gap by allowing malicious actors with access to a legitimate plugin provider's repository to create a new branch named exactly like the marketplace-pinned fingerprint, fill it with malicious code, and set it as the default branch.

During the next automatic update, the coding agent retrieves the branch instead of the verified commit and automatically executes the malicious code. Alternatively, attackers can publish a seemingly harmless plugin to obtain a SHA fingerprint from the marketplace and later add malicious code to it. This attack only functions on marketplaces that allow branch names to resemble commit hashes. GitHub rejects such names, but marketplaces on Bitbucket, GitLab, or self-hosted Git servers are considered vulnerable according to AIR Security.

AIR Security discovered the Plugin4Shell vulnerability in May 2026 but only published the information now to give affected companies time to react. Anthropic, OpenAI, Microsoft, and Google were informed in June 2026. Microsoft has not yet responded, according to AIR's blog post. Anthropic closed the vulnerability in version 2.1.179 of Claude Code, released on GitHub on June 16. AIR confirmed the fix in version 0.146.0 of Codex in early August. On August 4, Google confirmed that Gemini CLI for consumer users will be discontinued and will not receive a fix, while enterprise access via Gemini Code Assist or Google Cloud remains unaffected.