--- title: Zero-click RCE flaw in AI coding agents let attackers... description: A zero-click remote code execution vulnerability dubbed Plugin4Shell affects multiple AI coding agents, including Claude Code, OpenAI Codex, Gemini CLI, and... canonical: https://daily.dev/posts/zero-click-rce-flaw-in-ai-coding-agents-let-attackers-swap-in-malicious-plugins-kmy9j53rq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Zero-click RCE flaw in AI coding agents let attackers swap in malicious plugins | daily.dev og:description: A zero-click remote code execution vulnerability dubbed Plugin4Shell affects multiple AI coding agents, including Claude Code, OpenAI Codex, Gemini CLI, and... og:url: https://daily.dev/posts/zero-click-rce-flaw-in-ai-coding-agents-let-attackers-swap-in-malicious-plugins-kmy9j53rq og:image: https://api.daily.dev/og/posts/KmY9J53Rq.png og:image:alt: Zero-click RCE flaw in AI coding agents let attackers swap in malicious plugins og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Zero-click RCE flaw in AI coding agents let attackers swap in malicious plugins **[Collections](https://daily.dev/sources/collections)** · 2 min read · 4 upvotes · 0 comments ## Summary A zero-click remote code execution vulnerability dubbed Plugin4Shell affects multiple AI coding agents, including Claude Code, OpenAI Codex, Gemini CLI, and GitHub Copilot. The flaw lies in how these tools verify plugin code pinned to a Git commit SHA: they pass the SHA to Git for checkout but never confirm the resolved commit actually matches, letting an attacker who controls a plugin repo swap in malicious code that runs with the developer's full access — potentially exposing source code, credentials, and CI/CD pipelines. Discovered in May and disclosed to vendors in June, it has been patched in Claude Code 2.1.179 and Codex 0.146.0. Google opted to deprecate Gemini CLI instead of patching it, pushing users toward Antigravity, while GitHub has not fixed Copilot, citing naming restrictions on GitHub-hosted repos that researchers say don't cover marketplaces hosted elsewhere like Bitbucket. ## Content Security researchers at AIR disclosed a zero-click remote code execution vulnerability affecting four major AI coding agents: Claude Code, OpenAI Codex, GitHub Copilot, and Google Gemini CLI. They're calling it Plugin4Shell. ## How it works Plugin marketplaces typically pin add-ons to a specific git commit hash, which is supposed to guarantee you're running exactly the code you reviewed. The problem is that git, when given a reference that matches both a branch name and a commit hash, prefers the branch name. So if an agent is told to check out commit `abc123`, and the repo owner creates a branch literally named `abc123`, git will resolve to the branch - not the original commit. The agent never verifies which one it actually got. It just runs whatever code is there. For Gemini CLI, the researchers found a slightly different variant using `FETCH_HEAD` as the reference name, but the underlying logic is the same: the agent passes a reference to git and trusts the result without checking. Because these agents run with the same permissions as the developer, a successful exploit gets access to source code, credentials, cloud infrastructure, and CI/CD pipelines. No user interaction required. ## Who patched, who didn't The researchers discovered the flaw in May and disclosed it to vendors in June. Four months later, the response has been uneven: - **Anthropic** patched it in Claude Code 2.1.179 - **OpenAI** patched it in Codex 0.146.0 - **Google** deprecated Gemini CLI instead of patching, pointing users toward a replacement called Antigravity - **Microsoft** has not patched GitHub Copilot No CVE has been assigned and no formal advisory has been published. ## The GitHub dispute GitHub's position is that the real-world exposure is limited because GitHub-hosted repos block branch names that look like commit hashes. That's a reasonable point for GitHub specifically, but the researchers note it doesn't cover plugin marketplaces hosted on Bitbucket or self-hosted git servers, where no such restriction exists. The broader issue is that this is a vendor-side validation failure. Enterprises can reduce their exposure by auditing which plugins they use and where those repos are hosted, but they can't fix the underlying flaw themselves - that requires the agent to actually verify git resolved to the expected commit, not just trust the reference it passed in. ## Questions this post answers ### What is the Plugin4Shell vulnerability in AI coding agents like Claude Code and Copilot? Plugin4Shell is a zero-click remote code execution flaw in how AI coding agents verify plugin code pinned to a specific Git commit SHA. The agents pass the SHA to Git for checkout but never confirm Git actually resolved to that exact commit, letting an attacker who controls a plugin repository publish malicious code under the trusted SHA name, or via Gemini CLI's FETCH_HEAD reference, and have it run with full developer access without any user interaction. _Track how vendors patch supply chain flaws like this before pinning plugin versions in your own agent setup, via daily.dev._ ### Which AI coding agent versions fix the Plugin4Shell RCE vulnerability? Anthropic patched it in Claude Code version 2.1.179, and OpenAI fixed it in Codex version 0.146.0. Google chose not to patch Gemini CLI at all, instead deprecating it and directing users to Antigravity. GitHub has not released a fix for Copilot, arguing that naming restrictions on GitHub-hosted repositories limit the attack surface, though researchers note this doesn't cover plugin marketplaces hosted elsewhere like Bitbucket. _Developers deciding whether to keep using Gemini CLI or Copilot plugins can follow patch status updates on daily.dev._ ### Can enterprises mitigate the Plugin4Shell coding agent vulnerability without a vendor patch? Organizations can reduce exposure through measures like restricting plugin sources or monitoring repository changes, but the researchers who disclosed Plugin4Shell state clearly that the underlying validation flaw must be corrected by the vendor itself, since it stems from how the agent's code checks out Git commits rather than anything configurable on the enterprise side. _Teams weighing risk from unpatched agent plugins can watch for vendor fixes and advisories via daily.dev._ ## Similar posts on daily.dev - [The Plugin Was Trusted. The Code Wasn’t.](https://daily.dev/posts/the-plugin-was-trusted-the-code-wasn-t--ob4senb1p) · Medium · 0 upvotes · 0 comments - [Flaws in Claude Code Put Developers' Machines at Risk](https://daily.dev/posts/flaws-in-claude-code-put-developers-machines-at-risk-pkmhpix9s) · Dark Reading · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#ai-agents](https://daily.dev/tags/ai-agents), [#claude-code](https://daily.dev/tags/claude-code) [View this post on daily.dev](https://daily.dev/posts/zero-click-rce-flaw-in-ai-coding-agents-let-attackers-swap-in-malicious-plugins-kmy9j53rq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Zero-click RCE flaw in AI coding agents let attackers swap in malicious plugins","url":"https://daily.dev/posts/zero-click-rce-flaw-in-ai-coding-agents-let-attackers-swap-in-malicious-plugins-kmy9j53rq","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/zero-click-rce-flaw-in-ai-coding-agents-let-attackers-swap-in-malicious-plugins-kmy9j53rq"},"datePublished":"2026-09-18T16:03:09.980Z","dateModified":"2026-09-21T13:00:41.149Z","description":"A zero-click remote code execution vulnerability dubbed Plugin4Shell affects multiple AI coding agents, including Claude Code, OpenAI Codex, Gemini CLI, and...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9c0a2840e95bb5c7350f15f4170f6c1a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9c0a2840e95bb5c7350f15f4170f6c1a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/zero-click-rce-flaw-in-ai-coding-agents-let-attackers-swap-in-malicious-plugins-kmy9j53rq","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":4},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,ai-agents,claude-code","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Zero-click RCE flaw in AI coding agents let attackers swap in malicious plugins"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/zero-click-rce-flaw-in-ai-coding-agents-let-attackers-swap-in-malicious-plugins-kmy9j53rq#faq","mainEntity":[{"@type":"Question","name":"What is the Plugin4Shell vulnerability in AI coding agents like Claude Code and Copilot?","acceptedAnswer":{"@type":"Answer","text":"Plugin4Shell is a zero-click remote code execution flaw in how AI coding agents verify plugin code pinned to a specific Git commit SHA. The agents pass the SHA to Git for checkout but never confirm Git actually resolved to that exact commit, letting an attacker who controls a plugin repository publish malicious code under the trusted SHA name, or via Gemini CLI's FETCH_HEAD reference, and have it run with full developer access without any user interaction. Track how vendors patch supply chain flaws like this before pinning plugin versions in your own agent setup, via daily.dev."}},{"@type":"Question","name":"Which AI coding agent versions fix the Plugin4Shell RCE vulnerability?","acceptedAnswer":{"@type":"Answer","text":"Anthropic patched it in Claude Code version 2.1.179, and OpenAI fixed it in Codex version 0.146.0. Google chose not to patch Gemini CLI at all, instead deprecating it and directing users to Antigravity. GitHub has not released a fix for Copilot, arguing that naming restrictions on GitHub-hosted repositories limit the attack surface, though researchers note this doesn't cover plugin marketplaces hosted elsewhere like Bitbucket. Developers deciding whether to keep using Gemini CLI or Copilot plugins can follow patch status updates on daily.dev."}},{"@type":"Question","name":"Can enterprises mitigate the Plugin4Shell coding agent vulnerability without a vendor patch?","acceptedAnswer":{"@type":"Answer","text":"Organizations can reduce exposure through measures like restricting plugin sources or monitoring repository changes, but the researchers who disclosed Plugin4Shell state clearly that the underlying validation flaw must be corrected by the vendor itself, since it stems from how the agent's code checks out Git commits rather than anything configurable on the enterprise side. Teams weighing risk from unpatched agent plugins can watch for vendor fixes and advisories via daily.dev."}}]} ```