Zero-Click RCE Vulnerability Hit Four Major AI Coding Agents, Two Remain Unpatched
Help Net Security, Friday, September 18th, 2026
Plugin4Shell breaks SHA pinning in Claude Code, Codex, GitHub Copilot and Gemini CLI, and auto-update makes it zero-click.
Researchers at AIR found that Claude Code, Codex, GitHub Copilot and Gemini CLI all share a plugin SHA-pinning bypass they call Plugin4Shell, giving an attacker the same reach into company systems as the employee running the agent.
SHA pinning is supposed to lock an installed plugin to a specific reviewed commit, but all four agents check out the pinned commit without verifying the checkout actually landed there.
Claude Code, Codex and Copilot share one variant tied to how git handles branch names; Gemini CLI is exposed through a separate fetch-and-checkout mechanism with the same outcome.
Because the same git checkout re-runs on background auto-update, the default in Claude Code and Codex, the swap reaches already-installed plugins with no user action.