Unpatched verification gaps in trusted plugin marketplaces allow attackers to silently swap safe code for malicious revisions affecting developers’ systems
A newly disclosed zero click vulnerability dubbed Plugin4Shell could let attackers remotely run code on computers using certain AI coding agents, including Anthropic’s Claude Code, OpenAI’s Codex, Google’s Gemini CLI, and GitHub Copilot, according to Air Security.
The flaw can be exploited without any user interaction, potentially exposing a developer’s machine and any systems or resources that the affected agent can reach.
The issue lies in the way these agents handle plugins from ostensibly trusted marketplaces. Instead of attacking the underlying AI models, Plugin4Shell targets a weakness in plugin verification. The tools may retrieve the commit specified by a marketplace’s Secure Hash Algorithm pin, but fail to verify that the commit corresponds to the intended code. That gap could enable someone who controls a plugin repository to replace safe code with malicious code while making the pinned reference appear valid. Because installed plugins commonly update automatically, the attack can occur without a developer taking action.
Researchers said the flaw produces “zero-click remote code execution”:
- One possible route is for an attacker to submit an innocuous plugin that clears marketplace review and later alter its repository.
- Another is for an attacker to take over a legitimate plugin author’s repository and distribute a malicious revision to users who already installed the plugin.
The firm has notified the four vendors in June. Anthropic had fixed the issue in Claude Code version 2.1.179, and OpenAI has addressed it in Codex version 0.146.0. Google said it would not patch Gemini CLI because the product has been deprecated, advising users to move to its newer Antigravity agentic development environment instead. GitHub Copilot has not received a patch, according to Air.
GitHub has told The Register that its protections bar users from naming branches or tags in a way that imitates commit SHA values, which it argues stops the exploit on GitHub-hosted repositories. Air has disputed that conclusion, saying plugin marketplaces can be hosted elsewhere, including Bitbucket, where the same safeguard may not exist. In that scenario, Copilot could remain vulnerable.
The finding underscores the broader security exposure created as AI programming assistants become widely deployed. Separate research presented at Black Hat 2026 in August has found that coding agents from Anthropic, Google, and OpenAI could be susceptible to prompt-injection attacks that may enable credential theft and supply-chain compromise.
Air’s researchers say the reliable remedy is for vendors to fix the validation problem in the agent itself, and for users to install the updated version when one is available.
