Plugin4Shell: A Zero Click SHA-Pinning Bypass Hits Claude Code, Codex, Copilot and Gemini CLI

A zero click supply chain flaw called Plugin4Shell affects four major AI coding agents at once, Claude Code, Codex, GitHub Copilot and Gemini CLI, and breaks the exact mechanism developers rely on to trust a reviewed plugin. Anthropic and OpenAI have patched it. Microsoft has not shipped a fix for Copilot. Google deprecated Gemini CLI outright rather than fix it, leaving every existing install exposed indefinitely.

Quick guide

1. List every AI coding agent your team uses: Claude Code, Codex, GitHub Copilot, Gemini CLI or others, and note the installed version of each.
2. For Claude Code, update to version 2.1.179 or later, which Anthropic shipped after this disclosure.
3. For Codex, update to version 0.146.0 or later, which OpenAI shipped after this disclosure.
4. For GitHub Copilot, check for a fix before relying on plugin pinning for security, since no patch had shipped as of this writing.
5. For Gemini CLI, treat every existing install as exposed indefinitely and follow Google’s guidance to move to its newer agent, Antigravity, which does not use the vulnerable plugin pinning system.
6. In the meantime, review which third party plugins or skills your agents have installed, and remove any you do not actively need, since fewer installed plugins means a smaller attack surface regardless of the patch status.

How the bypass works

AI coding agents that support plugins or skills let developers pin an installed plugin to a specific, reviewed commit by its SHA hash, so it cannot silently change after review. According to research from AIR, all four affected agents check out the pinned commit without verifying the checkout actually landed on that exact commit, letting an attacker swap in malicious code while the pin still looks intact. AIR calls this a plugin SHA pinning bypass. Claude Code, Codex and GitHub Copilot share one version tied to how git handles branch names, while Gemini CLI is exposed through a separate mechanism with the same outcome.

The bug depends on git allowing a branch to be named exactly like a commit hash, 40 hexadecimal characters. That is git’s default behavior. Some hosts reject it outright, GitHub does not allow a 40 character hex branch name, but others, including Bitbucket and any self hosted git server, allow it.

Why it is zero click

This is not only an install time risk. The same git checkout logic runs again on background auto update, which is the default in Claude Code and Codex, so when a marketplace updates the pinned SHA for a plugin, the malicious swap reaches every already installed copy with no action from the user at all. A developer who reviewed a plugin, pinned it correctly, and never touches it again can still end up running attacker code weeks later.

Two ways an attacker exploits it

• Slow burn: publish a plugin that behaves exactly as advertised, let it pass review and get adopted, then turn it malicious later. AIR says it demonstrated this approach in earlier research, where a test plugin it built spread to more than 26,000 agents before being pulled.
• Account takeover: take over the repository behind a plugin developers already trust and use the same pinning bypass to push malicious code to everyone with it installed. AIR’s related research, called SkillJacking, found 925 skills already in active use had been hijacked from their original maintainers, reaching 134,000 agents.

What actually goes wrong

SHA pinning exists specifically to give developers a false sense of permanence, exactly the property this bug quietly removes. A team that did everything right, reviewed a plugin, pinned it to a specific commit, and trusted that pin to hold, has no signal that anything changed. The plugin still shows the same pinned hash in configuration. Meanwhile the code actually running can be anything an attacker chose to push. Because the exploited agents run with the same privileges as the developer using them, a compromised coding agent plugin can read source code, secrets in the environment, and anything else the developer’s own account can reach.

FAQ

Is this the same as a normal supply chain attack on npm or PyPI packages?

No. This specifically defeats the SHA pinning mechanism inside the AI agent itself, not a package registry’s own signing or verification. AIR describes it as the first supply chain vulnerability specific to the AI agent ecosystem.

Does removing all plugins fully protect me?

Removing plugins you do not need reduces exposure, but any agent that supports plugins and shares the vulnerable checkout logic remains exposed for as long as it has any plugin installed and the underlying bug is unpatched.

How was this discovered and disclosed?

Researchers at AIR found the bug in May 2026 with working proof of concept exploits against all four agents and disclosed it to each vendor the following month, ahead of public reporting in September 2026.

Sources

Reporting on AIR’s Plugin4Shell research, including vendor patch status for Claude Code, Codex, GitHub Copilot and Gemini CLI.