Plugin4Shell Vulnerability Exposes Major AI Coding Agents to Zero-Click RCE
A critical 'Plugin4Shell' vulnerability allows attackers to achieve zero-click remote code execution in popular AI coding agents, potentially compromising sensitive data and systems.
A newly discovered zero-click vulnerability, dubbed "Plugin4Shell," poses a significant threat to major AI coding agents, including Anthropic's Claude Code, OpenAI's Codex, Google's Gemini CLI, and Microsoft's Copilot. This exploit targets the trusted plugin marketplaces used by these agents, enabling attackers to inject malicious code that the agents will then execute without any user interaction. The potential impact is severe, as a successful exploitation could grant attackers full access to all assets and data accessible by the compromised agent.
Researchers at the security startup Air identified Plugin4Shell as a "first-of-its-kind AI supply-chain attack." Unlike previous exploits that targeted the AI models themselves, this vulnerability focuses on the integrity of the plugin ecosystems. By compromising these marketplaces, attackers can potentially reach millions of users and machines that rely on these AI coding tools for their development workflows. Microsoft itself notes that nearly 90 percent of Fortune 500 companies utilize Copilot, underscoring the widespread risk.
The vulnerability stems from how AI agents enforce the SHA-pinning mechanism in plugin marketplaces. This mechanism is designed to lock plugins to a specific, immutable commit hash, preventing supply chain attacks by ensuring that even if a repository is compromised, the agent continues to use the previously audited code. However, Plugin4Shell exploits a bypass of this very mechanism. The agent checks out the pinned commit but fails to verify its integrity, allowing an attacker controlling the plugin's repository to substitute malicious code while the pin still appears to be honored.
This bypass results in zero-click remote code execution because the agents' auto-update features are often enabled by default. When an attacker modifies the pinned commit upstream, the agent automatically updates its installed plugins with the malicious version. The Air researchers demonstrated two primary attack vectors: first, submitting a benign plugin that is later replaced with malicious code, and second, hijacking a legitimate author's repository to push malicious updates to all agents that have it installed.
In response to the disclosure in June, Anthropic and OpenAI have already released patches for their respective agents. Claude Code version 2.1.179 and Codex version 0.146.0 are now protected. Google has deprecated the Gemini CLI, opting not to patch it but recommending users migrate to its newer, protected Antigravity agentic development environment.
Microsoft's response has been mixed. While a GitHub spokesperson stated that Plugin4Shell does not affect GitHub due to its specific mitigation against SHA-like branch or tag names, the Air researchers argue this is insufficient as marketplaces can be hosted on other platforms like Bitbucket. Microsoft Copilot remains vulnerable because it supports these external marketplaces. Microsoft has not yet responded to requests for comment regarding Copilot's vulnerability, despite being notified in June.
The Plugin4Shell vulnerability highlights a critical gap in the security of AI supply chains. As AI agents become more integrated into development and enterprise workflows, the integrity of their plugin ecosystems is paramount. The ability for attackers to achieve zero-click RCE through compromised marketplaces underscores the need for more robust verification processes and immediate patching by vendors.
This incident serves as a stark reminder of the evolving threat landscape surrounding AI technologies. The researchers' earlier "SkillJacking" and "RepoJacking" proof-of-concept attacks, combined with Plugin4Shell, demonstrate a complete end-to-end attack chain that can compromise AI agents at scale, bypassing built-in security measures.