A zero-click remote code execution vulnerability affects all four major AI coding agents — Anthropic's Claude Code, OpenAI's Codex, GitHub Copilot, and Google's Gemini CLI — and could give attackers the same access to enterprise systems and data as the developer running the agent1,6. Two of the four agents remain unpatched.
Researchers at AIR, a cybersecurity startup, discovered the flaw in May 2026 and disclosed it to each vendor the following month. They dubbed the exploit Plugin4Shell and called it the first supply-chain vulnerability of the AI agent ecosystem4.
How the bypass works
The bug breaks SHA pinning, the mechanism developers rely on to lock an installed plugin to a specific, reviewed Git commit. When an agent installs or updates a plugin, it performs a Git checkout using a pinned 40-character commit hash. AIR's researchers — Or Nevo, Dor Granat, and Niv Hoffman — found that every affected agent checks out the pinned commit but never verifies the working tree actually matches that hash3,5.
For Claude Code, Codex, and GitHub Copilot, an attacker who controls a plugin repository can create a branch whose name matches the 40-hex commit hash and set it as the repository's default. Git resolves branch names over commit hashes, so the agent silently checks out the malicious branch while the pin still appears intact. Gemini CLI is exposed through a separate mechanism: its installation process fetches a pinned commit but then checks out FETCH_HEAD, which an attacker can redirect to a malicious branch.
The attack is classified as zero-click because Claude Code and Codex automatically update installed plugins in the background by default2. An attacker could publish a benign plugin, pass marketplace review, wait for adoption, then swap in malicious code that deploys without installation prompts or user interaction.
Patch status and vendor responses
Anthropic patched Claude Code in version 2.1.179. OpenAI addressed the flaw in Codex 0.146.0. Google has deprecated Gemini CLI entirely rather than patching it, advising users to migrate to AntiGravity, its newer agentic development environment that does not use the vulnerable plugin-pinning system.
Microsoft has not shipped a fix for Copilot. GitHub told The Register it already blocks branch and tag names that resemble commit SHAs on its own platform, which it said prevents the vulnerability from being exploited on GitHub-hosted repositories or its marketplace. AIR's researchers countered that the mitigation is insufficient because Copilot supports plugins from other platforms such as Bitbucket and self-hosted Git servers, which do allow 40-hex branch names.
Scale of exposure
Microsoft has said almost 90 percent of Fortune 500 companies use Copilot. AIR said it had previously demonstrated a related attack approach — SkillJacking — in which a plugin it built spread to more than 26,000 agents before being pulled. In separate research, AIR found 925 skills already in active use had been hijacked from their original maintainers, reaching 134,000 agents.
Malicious plugins exploiting Plugin4Shell could access source code, steal API keys or cloud credentials, alter repositories, or reach CI/CD pipelines and other corporate systems. AIR's researchers said the fix must ship in the agent itself because marketplaces cannot reliably enforce how a local Git client resolves a pin. The recommended post-checkout verification is a test confirming the resolved HEAD matches the pinned SHA, aborting if it does not.
ANALYSIS The unpatched state of Copilot, combined with Microsoft's own claim of near-universal Fortune 500 adoption, leaves a large enterprise attack surface open even after the disclosure.