Zero-click RCE vulnerability in AI coding agents Plugin4Shell
Researchers at cybersecurity startup AIR discovered a zero-click remote code execution vulnerability called Plugin4Shell affecting four major AI coding agents: Codex, Claude Code, Gemini CLI, and GitHub Copilot. The flaw allows attackers to execute malicious code by substituting a trusted plugin with malicious code, potentially giving attackers access to enterprise systems. Most vendors have released patches for the vulnerability.
What happened
Researchers at cybersecurity startup AIR discovered a zero-click remote code execution (RCE) vulnerability affecting AI coding agents including OpenAI's Codex, Anthropic's Claude Code, Google's Gemini CLI, and Microsoft-owned GitHub Copilot. The vulnerability, named Plugin4Shell, allowed attackers to execute malicious code without developer interaction by swapping a trusted plugin from an online marketplace for a malicious one.
The flaw exploits how these agents handle plugin installations. When developers install a plugin, the agent downloads code from a Git repository and uses a secure hash algorithm (SHA) to verify it is an approved version. However, Claude Code, Codex, and GitHub Copilot pass the SHA directly to Git without subsequently verifying that Git actually checked out the commit corresponding to that SHA. An attacker controlling the plugin repository can create a malicious version and use the SHA of a legitimate commit as its name, causing the agent to execute malicious code instead of the trusted plugin.
Reported impact
The vulnerability could give an attacker the same reach into a company's systems and data as the employee running the agent, potentially exposing enterprise development environments. It was described as the first supply chain vulnerability of the AI agent ecosystem.
Index analysis
Most vendors released patches for Plugin4Shell after AIR reported the flaw. The researchers noted it is a flaw no marketplace can fix, requiring users to update their agent.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.