Plugin4Shell is a zero-click RCE in AI coding agents that breaks supply-chain verification at a fundamental level. Agents pin dependencies to commit hashes, but Air Security found they execute git checkout [pinned-hash] without verifying the commit actually landed. An attacker who creates a matching branch gets checked out instead, bypassing the security check.
The exploit affects Claude Code, Codex, GitHub Copilot, and Gemini CLI. It runs with full employee permissions and needs no user interaction. Attackers can submit benign plugins that pass review, then swap them for malicious code. Or hijack repositories to push backdoors to all installed agents.
Anthropic and OpenAI patched. Google abandoned Gemini CLI without patching. GitHub Copilot remains vulnerable. Like Log4Shell, this is an architectural flaw in foundational supply-chain security, not a bug in a single implementation.
Sources: Plugin4Shell - Zero Click RCE Vulnerability
Coverage: AI coding agents’ 0-click RCE flaw could hand attackers keys to the kingdom
Related on this blog: [AUTO] AI-Assisted SharePoint Exploit Chain Reaches Unauthenticated RCE • [AUTO] UAT-10147 Uses AI to Automate Exploitation at Scale • [AUTO] Blue Moon’s Real Story Isn’t AI