Plugin4Shell: A Zero-Click Exploit Hit Claude Code, Codex, Copilot, and Gemini CLI

What Plugin4Shell actually is

If you install plugins into an AI coding agent and trust the SHA pin next to the package name, Air Security's Plugin4Shell disclosure is worth reading closely. The researchers describe it plainly: every one of the four agents they tested — Claude Code, Codex, GitHub Copilot, and Gemini CLI — checks out the commit a plugin marketplace pinned by SHA, but never verifies the checkout actually landed on that commit. An attacker who controls a plugin's git repository can exploit how git resolves branch names to make the agent check out a malicious branch while the pin still displays as valid.

Per Help Net Security's reporting, the exploit mechanics differ slightly by platform: on Bitbucket and self-hosted git servers, an attacker can name a branch identically to the 40-character commit hash the marketplace pinned, and git resolves the pin to the malicious branch instead of the real commit. GitHub itself blocks this specific trick by rejecting 40-hex branch names, which is part of why the impact varies across tools that use different git hosts under the hood.

Why this counts as zero-click

The "zero-click" label matters because it removes the usual defense against a bad plugin: developer review. Normally, swapping a plugin's code requires either compromising the marketplace listing or getting a developer to approve an unreviewed update. Here, the SHA pin is the thing developers rely on to know the code they reviewed is the code that runs — and Plugin4Shell breaks exactly that guarantee without needing the developer to click, approve, or notice anything. Air Security called it the first supply chain vulnerability of the AI agent ecosystem, which is a fair framing: this is a software-supply-chain bug wearing an AI-agent costume, and it will not be the last one, since every agent that pulls third-party plugins by reference has the same class of trust-boundary problem to get right.

Patch status, tool by tool

• Claude Code — patched in version 2.1.179. If you use Claude Code plugins, update now and confirm you're on 2.1.179 or later.
• Codex — patched in version 0.146.0. Same advice: check your version before assuming you're covered.
• GitHub Copilot — unpatched as of disclosure. Microsoft had not shipped a fix at the time Air Security and Help Net Security published.
• Gemini CLI — will not be patched. Google has deprecated the tool and is directing users toward its replacement, Antigravity, rather than fixing the underlying agent.

The practical split is stark: two vendors closed the hole within the disclosure window, and two did not. If your team runs Copilot or Gemini CLI with third-party plugins pinned by SHA, that pin is not currently doing the job you think it's doing.

What to actually do about it

Three concrete moves. First, update Claude Code and Codex to the patched versions above if you haven't already — this is a five-minute fix that closes a real hole. Second, for Copilot and Gemini CLI, treat any third-party plugin as unverified regardless of what SHA it claims to be pinned to, and prefer first-party or well-known plugins until a fix ships. Third, if you maintain your own plugin marketplace or internal agent tooling, this is a good prompt to check whether your own checkout logic verifies the landed commit hash after checkout, not just before — that's the exact gap Air Security found, and it's a cheap thing to audit in an afternoon.

Sources: Air Security — Plugin4Shell disclosure; Help Net Security — Plugin4Shell coverage. Analysis and framing by Precision AI Academy.

Common questions

Is Plugin4Shell fixed in Claude Code? Yes. Anthropic patched it in Claude Code version 2.1.179. Update to that version or later.

Is Gemini CLI getting a fix? No. Google has deprecated Gemini CLI and is not patching it; the company is directing users to Antigravity instead, per Help Net Security's reporting.

Does this affect every plugin I've installed, or just ones from untrusted sources? The vulnerability affects any plugin the agent installs by resolving a SHA-pinned commit, since the checkout-verification step is missing regardless of who published the plugin. The real-world risk is highest for plugins hosted on platforms that allow branch names matching commit hashes, such as Bitbucket or self-hosted git servers.