Zero-Click RCE Vulnerability in Four Major AI Coding Agents, Two Unpatched

Post Views: 2

A zero-day remote code execution flaw has affected four leading AI coding agents, with two remaining vulnerable despite disclosure.

Vulnerability Details

The flaw, designated Plugin4Shell, exploits a critical weakness in the software supply chain of AI assistant platforms, enabling adversaries to execute arbitrary code without user interaction. The affected systems include Claude Code, Codex, GitHub Copilot, and Gemini CLI, all of which rely on plugin ecosystems for extended functionality.

SHA Pinning Mechanism

Researchers from AIR identified the vulnerability in May 2026, revealing its potential to grant attackers equivalent access to internal systems as authorized users. The flaw undermines the SHA pinning mechanism, a security feature designed to ensure plugins remain locked to verified code versions.

Git Repository Manipulation

Attackers can bypass this safeguard by manipulating Git repository operations, allowing malicious code to replace legitimate plugin components without triggering security alerts. This technique exploits how certain platforms handle branch names resembling cryptographic hashes, a default behavior in Git that some hosting services like Bitbucket and self-hosted servers permit.

Attack Vectors

Malicious Plugin Deployment: Threat actors first submit a seemingly benign plugin that passes review processes. Once adopted by users, the plugin is later modified to include malicious payloads. AIR demonstrated this method in prior research, where a test plugin infected over 26,000 agents before removal.

Repository Takeover: Attackers compromise existing plugins by seizing control of their underlying repositories. By leveraging the same pinning bypass, they propagate malicious updates to all installed instances of the affected plugin. This approach, termed SkillJacking by researchers, revealed 925 hijacked plugins in active use, impacting 134,000 agents.

Vendor Responses

The flaw’s zero-click nature stems from automated update mechanisms inherent in some platforms. For example, Claude Code and Codex automatically refresh plugins during background updates, propagating the vulnerability without user intervention. This contrasts with manual update processes, which could mitigate risks if users actively managed plugin versions.

Vendors responded unevenly to the disclosure. Anthropic addressed the issue in Claude Code version 2.1.179, while OpenAI resolved it in Codex 0.146.0. Microsoft, however, has not released a patch for GitHub Copilot, leaving its user base exposed. Google took a different approach by discontinuing support for Gemini CLI entirely, urging users to migrate to its newer Antigravity agent, which avoids the plugin pinning system altogether.

Implications and Mitigation

The vulnerability highlights systemic risks in AI agent ecosystems, where trust in marketplace reviews and automated update systems can be exploited. Researchers emphasize that no marketplace can independently secure against this flaw, as the exploit resides within the agents’ internal processes.

“The only comprehensive mitigation remains vendor-implemented patches, with no alternative workarounds available for unpatched systems.”

Organizations using affected AI coding agents are advised to monitor vendor updates closely and consider transitioning to alternative tools where necessary. The incident underscores the need for heightened scrutiny of third-party integrations in AI platforms, as supply chain attacks continue to evolve in complexity.