A zero-click vulnerability that allows remote code execution affects all of the major AI coding agents - Anthropic’s Claude Code, OpenAI’s Codex, Google's Gemini CLI, Microsoft’s Copilot, and Microsoft-owned GitHub Copilot - and could give attackers full access to every asset and piece of data that the agent can reach, researchers say.

The exploit, dubbed “Plugin4Shell,” is a “first-of-its-kind AI supply-chain attack,” according to threat hunters at Air, a security startup focused on protecting enterprise AI agents.

Instead of targeting the model or agent, Plugin4Shell attacks trusted marketplaces that host plugins for major coding agents. Such attacks could therefore reach millions of users and machines, the researchers said.

Almost 90 percent of Fortune 500 companies use Copilot, according to Microsoft, which also happens to be one of the two that didn’t ship a patch for the flaw.

“The fix has to ship in the agent, and updating is the only complete mitigation where one exists,” Air researchers Or Nevo, Dor Granat, and Niv Hoffman said in a Thursday report.

The Air team reported the security issue to all four vendors in June, and both Anthropic and OpenAI patched it in Claude Code 2.1.179 and Codex 0.146.0, respectively.

Google has deprecated the Gemini CLI, and therefore told Air it will not patch, so every install remains vulnerable. Google does, however, suggest users migrate to its newer Antigravity agentic development environment, which is protected from this attack.

Microsoft didn’t fix the flaw in Copilot. However, a GitHub spokesperson told us the Plugin4Shell attacks do not affect GitHub.

“To prevent abuse of SHAs, GitHub does not allow users to create branch or tag names that resemble commit SHAs,” the spokesperson said. “This mitigation ensures the reported vulnerability cannot be exploited on GitHub.”

The Air researchers said that the GitHub mitigation isn’t sufficient to defeat Plugin4Shell attacks. This is “because marketplaces can also be hosted in other platforms such as Bitbucket,” the team told The Register. 

“Microsoft Copilot is also still vulnerable because it supports marketplaces from such platforms as well, which exposes it to the vulnerability,” the researchers added. “Air also reported the same to Microsoft (since June), but unfortunately due [to] the amount of disclosure volume they’re currently getting we didn’t get a response from them.”

Redmond did not immediately respond to The Register’s request for comment.

The security hole sits in how agents enforce marketplaces’ SHA-pinning mechanism, which locks agent plugins and skills to a specific, immutable commit hash instead of a mutable reference like a version tag or branch name.

This aims to prevent supply chain attacks: If a public skill repository is compromised, your AI agent will continue running the same, audited code hash it used when you pinned it instead of automatically pulling new, malicious payloads.

The researchers describe the vulnerability as a “plugin SHA-pinning bypass.”

“The agent checks out the exact commit the marketplace pinned but never verifies it landed there, so an attacker who controls the plugin's repo makes the checkout resolve to malicious code while the pin still looks honored," Nevo, Granat, and Hoffman wrote. “The result is zero-click remote code execution.”

Agents’ plugin auto-update feature makes this a zero-click attack. When a pinned commit is swapped upstream, the agent’s plugin gets replaced with a malicious version, and both Claude and Codex automatically update installed plugins by default.

The researchers say an attacker could abuse this flaw in two ways. In one scenario, the attacker submits a benign plugin to a trusted marketplace, the plugin passes review, and then the attacker later replaces the benign content with malicious code.

The second attack involves hijacking a legitimate author's repository and then pushing the malicious version onto every agent that has it installed - essentially bypassing the SHA pinning safety mechanism that exists to stop this type of supply chain attack. The team demonstrates this type of takeover in their earlier SkillJacking and RepoJacking proof-of-concept attacks. 

“Together, the chain is proven end to end - takeovers happen at scale, and Plugin4Shell defeats the mechanism built to contain them,” the researchers wrote. ®