A zero-click remote code execution vulnerability affects every major AI coding agent, including Anthropic's Claude Code, OpenAI's Codex, Google's Gemini CLI, Microsoft's Copilot, and GitHub Copilot, according to researchers at AIR, a security startup focused on enterprise AI agent protection1.
The exploit, dubbed Plugin4Shell, targets the trusted marketplaces that host plugins for these coding agents rather than the models or agents themselves. AIR called it a "first-of-its-kind AI supply-chain attack" and said it could reach millions of users and machines. Microsoft has said almost 90 percent of Fortune 500 companies use Copilot.
How the bypass works
The flaw sits in how agents enforce marketplaces' SHA-pinning mechanism, which is designed to lock plugins to a specific, immutable commit hash rather than a mutable reference like a version tag or branch name. In practice, the agent checks out the exact commit the marketplace pinned but never verifies it actually landed there, allowing malicious code to be resolved while the pin still appears honored. Because Claude Code and Codex automatically update installed plugins by default, an attacker could submit a benign plugin to a trusted marketplace, pass review, and later replace it with malicious code. Alternatively, an attacker could hijack a legitimate author's repository and push the malicious version onto every agent with the plugin installed. AIR's team previously demonstrated this class of takeover in SkillJacking and RepoJacking proof-of-concept attacks.
Patching split across vendors
AIR researchers Or Nevo, Dor Granat, and Niv Hoffman reported the issue to all four vendors in June. Anthropic patched the flaw in Claude Code 2.1.179, and OpenAI patched it in Codex 0.146.0. Google has deprecated Gemini CLI and told AIR it will not patch it, suggesting users migrate to its newer AntiGravity agentic development environment, which Google said is protected from this attack.
Microsoft did not fix the flaw in Copilot. A GitHub spokesperson said Plugin4Shell attacks do not affect GitHub because GitHub does not allow users to create branch or tag names that resemble commit SHAs. AIR's researchers disputed that assessment, saying GitHub's mitigation is not sufficient to defeat Plugin4Shell attacks. They added that Microsoft Copilot remains vulnerable because it supports marketplaces from other platforms such as Bitbucket.
The researchers said the fix must ship in the agent itself and that updating is the only complete mitigation where one exists.
ANALYSIS The divergent vendor responses leave a practical gap: Anthropic and OpenAI have patched, and Google has deprecated the affected product, but Microsoft has not fixed Copilot and the researchers dispute GitHub's claimed mitigation. Organizations running unpatched agents in environments that touch third-party plugin marketplaces face residual risk that no configuration change can close without an agent-level update.
OpenAI separately disclosed six agent misbehavior incidents on September 16[3].