--- title: Zero-click RCE flaw in AI coding agents let attackers... description: A zero-click remote code execution vulnerability dubbed Plugin4Shell affects multiple AI coding agents, including Claude Code, OpenAI Codex, Gemini CLI, and... canonical: https://daily.dev/posts/zero-click-rce-flaw-in-ai-coding-agents-let-attackers-swap-in-malicious-plugins-kmy9j53rq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Zero-click RCE flaw in AI coding agents let attackers swap in malicious plugins | daily.dev og:description: A zero-click remote code execution vulnerability dubbed Plugin4Shell affects multiple AI coding agents, including Claude Code, OpenAI Codex, Gemini CLI, and... og:url: https://daily.dev/posts/zero-click-rce-flaw-in-ai-coding-agents-let-attackers-swap-in-malicious-plugins-kmy9j53rq og:image: https://api.daily.dev/og/posts/KmY9J53Rq.png og:image:alt: Zero-click RCE flaw in AI coding agents let attackers swap in malicious plugins og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Zero-click RCE flaw in AI coding agents let attackers swap in malicious plugins **[Collections](https://daily.dev/sources/collections)** · 2 min read · 1 upvotes · 0 comments ## Summary A zero-click remote code execution vulnerability dubbed Plugin4Shell affects multiple AI coding agents, including Claude Code, OpenAI Codex, Gemini CLI, and GitHub Copilot. The flaw lies in how these tools verify plugin code pinned to a Git commit SHA: they pass the SHA to Git for checkout but never confirm the resolved commit actually matches, letting an attacker who controls a plugin repo swap in malicious code that runs with the developer's full access — potentially exposing source code, credentials, and CI/CD pipelines. Discovered in May and disclosed to vendors in June, it has been patched in Claude Code 2.1.179 and Codex 0.146.0. Google opted to deprecate Gemini CLI instead of patching it, pushing users toward Antigravity, while GitHub has not fixed Copilot, citing naming restrictions on GitHub-hosted repos that researchers say don't cover marketplaces hosted elsewhere like Bitbucket. ## Content Security researchers at AIR disclosed a zero-click remote code execution vulnerability affecting several popular AI coding agents, including Claude Code, OpenAI Codex, Google Gemini CLI, and GitHub Copilot. They're calling it Plugin4Shell. The flaw is in how these agents verify plugin code. When told to use a specific, trusted version of a plugin via a Git commit SHA, the agents pass that SHA to Git for checkout but never confirm Git actually resolved to that exact commit. An attacker who controls a plugin repository can create a new version using the legitimate SHA as a name — or in Gemini CLI's case, the `FETCH_HEAD` reference — and the agent will pull and run the malicious code without complaint. Because coding agents typically run with the same access as the developer, a successful exploit could expose source code, credentials, cloud infrastructure, and CI/CD pipelines. No user interaction required. The vulnerability was discovered in May and disclosed to vendors in June. Anthropic patched it in Claude Code 2.1.179. OpenAI fixed it in Codex 0.146.0. Google chose to deprecate Gemini CLI rather than patch it, directing users to Antigravity instead. GitHub has not released a fix for Copilot, arguing that naming restrictions on GitHub-hosted repositories limit the attack surface — though researchers point out this doesn't apply to plugin marketplaces hosted elsewhere, like Bitbucket. The researchers are clear that this is a vendor problem, not something enterprises can fix on their end. Organizations can reduce exposure, but the underlying validation flaw has to be corrected at the source. ## Questions this post answers ### What is the Plugin4Shell vulnerability in AI coding agents like Claude Code and Copilot? Plugin4Shell is a zero-click remote code execution flaw in how AI coding agents verify plugin code pinned to a specific Git commit SHA. The agents pass the SHA to Git for checkout but never confirm Git actually resolved to that exact commit, letting an attacker who controls a plugin repository publish malicious code under the trusted SHA name, or via Gemini CLI's FETCH_HEAD reference, and have it run with full developer access without any user interaction. _Track how vendors patch supply chain flaws like this before pinning plugin versions in your own agent setup, via daily.dev._ ### Which AI coding agent versions fix the Plugin4Shell RCE vulnerability? Anthropic patched it in Claude Code version 2.1.179, and OpenAI fixed it in Codex version 0.146.0. Google chose not to patch Gemini CLI at all, instead deprecating it and directing users to Antigravity. GitHub has not released a fix for Copilot, arguing that naming restrictions on GitHub-hosted repositories limit the attack surface, though researchers note this doesn't cover plugin marketplaces hosted elsewhere like Bitbucket. _Developers deciding whether to keep using Gemini CLI or Copilot plugins can follow patch status updates on daily.dev._ ### Can enterprises mitigate the Plugin4Shell coding agent vulnerability without a vendor patch? Organizations can reduce exposure through measures like restricting plugin sources or monitoring repository changes, but the researchers who disclosed Plugin4Shell state clearly that the underlying validation flaw must be corrected by the vendor itself, since it stems from how the agent's code checks out Git commits rather than anything configurable on the enterprise side. _Teams weighing risk from unpatched agent plugins can watch for vendor fixes and advisories via daily.dev._ ## Similar posts on daily.dev - [Flaws in Claude Code Put Developers' Machines at Risk](https://daily.dev/posts/flaws-in-claude-code-put-developers-machines-at-risk-pkmhpix9s) · Dark Reading · 0 upvotes · 0 comments - [Security Flaws in Anthropic’s Claude Code Risk Stolen Data, System Takeover](https://daily.dev/posts/security-flaws-in-anthropic-s-claude-code-risk-stolen-data-system-takeover-j81sidgwk) · DevOps.com · 1 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#ai-agents](https://daily.dev/tags/ai-agents), [#claude-code](https://daily.dev/tags/claude-code) [View this post on daily.dev](https://daily.dev/posts/zero-click-rce-flaw-in-ai-coding-agents-let-attackers-swap-in-malicious-plugins-kmy9j53rq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Zero-click RCE flaw in AI coding agents let attackers swap in malicious plugins","url":"https://daily.dev/posts/zero-click-rce-flaw-in-ai-coding-agents-let-attackers-swap-in-malicious-plugins-kmy9j53rq","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/zero-click-rce-flaw-in-ai-coding-agents-let-attackers-swap-in-malicious-plugins-kmy9j53rq"},"datePublished":"2026-09-18T16:03:09.980Z","dateModified":"2026-09-18T16:03:49.607Z","description":"A zero-click remote code execution vulnerability dubbed Plugin4Shell affects multiple AI coding agents, including Claude Code, OpenAI Codex, Gemini CLI, and...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9c0a2840e95bb5c7350f15f4170f6c1a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9c0a2840e95bb5c7350f15f4170f6c1a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/zero-click-rce-flaw-in-ai-coding-agents-let-attackers-swap-in-malicious-plugins-kmy9j53rq","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,ai-agents,claude-code","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Zero-click RCE flaw in AI coding agents let attackers swap in malicious plugins"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/zero-click-rce-flaw-in-ai-coding-agents-let-attackers-swap-in-malicious-plugins-kmy9j53rq#faq","mainEntity":[{"@type":"Question","name":"What is the Plugin4Shell vulnerability in AI coding agents like Claude Code and Copilot?","acceptedAnswer":{"@type":"Answer","text":"Plugin4Shell is a zero-click remote code execution flaw in how AI coding agents verify plugin code pinned to a specific Git commit SHA. The agents pass the SHA to Git for checkout but never confirm Git actually resolved to that exact commit, letting an attacker who controls a plugin repository publish malicious code under the trusted SHA name, or via Gemini CLI's FETCH_HEAD reference, and have it run with full developer access without any user interaction. Track how vendors patch supply chain flaws like this before pinning plugin versions in your own agent setup, via daily.dev."}},{"@type":"Question","name":"Which AI coding agent versions fix the Plugin4Shell RCE vulnerability?","acceptedAnswer":{"@type":"Answer","text":"Anthropic patched it in Claude Code version 2.1.179, and OpenAI fixed it in Codex version 0.146.0. Google chose not to patch Gemini CLI at all, instead deprecating it and directing users to Antigravity. GitHub has not released a fix for Copilot, arguing that naming restrictions on GitHub-hosted repositories limit the attack surface, though researchers note this doesn't cover plugin marketplaces hosted elsewhere like Bitbucket. Developers deciding whether to keep using Gemini CLI or Copilot plugins can follow patch status updates on daily.dev."}},{"@type":"Question","name":"Can enterprises mitigate the Plugin4Shell coding agent vulnerability without a vendor patch?","acceptedAnswer":{"@type":"Answer","text":"Organizations can reduce exposure through measures like restricting plugin sources or monitoring repository changes, but the researchers who disclosed Plugin4Shell state clearly that the underlying validation flaw must be corrected by the vendor itself, since it stems from how the agent's code checks out Git commits rather than anything configurable on the enterprise side. Teams weighing risk from unpatched agent plugins can watch for vendor fixes and advisories via daily.dev."}}]} ```