Critical Flaw in AI Coding Agents Could Give Attackers Full System Access

Vulnerability Overview

A zero-click vulnerability allowing remote code execution affects all major AI coding agents, including Anthropic’s Claude Code, OpenAI’s Codex, Google’s Gemini CLI, Microsoft’s Copilot, and GitHub Copilot. The flaw, dubbed Plugin4Shell by researchers at security firm Air, could give attackers complete access to every asset and piece of data that a compromised agent can reach.

The exploit represents what researchers call a “first-of-its-kind AI supply-chain attack.” Rather than targeting the AI model or agent directly, Plugin4Shell attacks the trusted marketplaces that host plugins for these coding assistants. Such marketplaces serve millions of users and machines, amplifying the potential impact.

Technical Mechanism

The vulnerability lives in how agents enforce marketplaces’ SHA-pinning mechanism, which locks plugins and skills to a specific, immutable commit hash instead of a mutable reference like a version tag or branch name. This mechanism is designed to prevent supply chain attacks: if a public skill repository is compromised, an AI agent should continue running the same audited code it used when pinned.

But the researchers found a bypass. “The agent checks out the exact commit the marketplace pinned but never verifies it landed there,” researchers Or Nevo, Dor Granat, and Niv Hoffman wrote. “An attacker who controls the plugins repo makes the checkout resolve to malicious code while the pin still looks honored.” The result is zero-click remote code execution requiring no user interaction.

The attack succeeds because AI coding agents automatically update installed plugins by default. When a pinned commit is swapped upstream, the agent’s plugin gets replaced with a malicious version without any action required from the user.

Attack Scenarios

Researchers described two attack scenarios. In the first, an attacker submits a benign plugin to a trusted marketplace, waits for it to pass review, then replaces the benign content with malicious code. The second involves hijacking a legitimate author’s repository and pushing a malicious version to every agent that has the plugin installed.

Vendor Responses

Air reported the vulnerability to all four vendors in June. Anthropic and OpenAI have since patched it in Claude Code 2.1.179 and Codex 0.146.0, respectively. Google has deprecated the Gemini CLI entirely and told Air it will not issue a patch, leaving existing installations vulnerable. The company instead pointed users toward its newer Antigravity agentic development environment, which researchers confirm is protected from the attack.

Microsoft has not fixed the flaw in Copilot. According to Air, the volume of disclosures Microsoft currently receives delayed any response to their report.

GitHub disputed the vulnerability’s applicability to its product. A GitHub spokesperson told The Register that the platform prevents users from creating branch or tag names that resemble commit SHAs, which the company said “ensures the reported vulnerability cannot be exploited on GitHub.”

Air researchers pushed back on this claim. They noted that marketplaces can be hosted on other platforms like Bitbucket, and that Microsoft Copilot supports marketplaces from such platforms, keeping it vulnerable. “Microsoft Copilot is also still vulnerable because it supports marketplaces from such platforms as well, which exposes it to the vulnerability,” the researchers said.

Nearly 90 percent of Fortune 500 companies use Copilot, according to Microsoft. The company is among those that have not released a patch.

“The fix has to ship in the agent, and updating is the only complete mitigation where one exists,” the Air researchers said. The team previously demonstrated similar supply chain attack techniques in their SkillJacking and RepoJacking proof-of-concept work. “Together, the chain is proven end to end — takeovers happen at scale, and Plugin4Shell defeats the mechanism built to contain them,” they wrote.