Loading story…
Air disclosed Plugin4Shell, a zero-click remote-code-execution supply-chain flaw in plugin marketplaces used by major AI coding agents. The vulnerability can bypass plugin SHA pinning by causing a repository checkout pinned to an ostensibly immutable commit hash to resolve to attacker-controlled code, allowing a malicious plugin submission—or compromise of a legitimate plugin author's repository—to deliver code to installed agents.
Default plugin auto-updates make exploitation zero-click in Claude Code and OpenAI Codex, potentially granting attackers access to developer environments, source code, credentials, and connected infrastructure. Anthropic and OpenAI patched affected products; Air said Microsoft Copilot remains vulnerable and deprecated Gemini CLI installations will not be patched, while GitHub disputed that its platform can be exploited using the reported technique.
Trace attribution and downstream blast radius.
6 events from the most recent confirmed update back to the earliest known activity.
GitHub stated that Plugin4Shell does not affect GitHub because it blocks branch and tag names resembling commit SHAs. Air disputed that this mitigated the broader issue because agent marketplaces can also use platforms such as Bitbucket.
Google told Air it would not patch the flaw in deprecated Gemini CLI, leaving existing installations vulnerable. Google recommended users migrate to its Antigravity agentic development environment, which it said is protected from the attack.
OpenAI patched the Plugin4Shell issue in Codex version 0.146.0.
Anthropic patched the Plugin4Shell issue in Claude Code version 2.1.179.
Air researchers Or Nevo, Dor Granat, and Niv Hoffman disclosed Plugin4Shell, a supply-chain vulnerability affecting plugin marketplaces for Claude Code, OpenAI Codex, Gemini CLI, and Microsoft Copilot. The flaw can cause a pinned plugin checkout to resolve to attacker-controlled code and, where plugins auto-update, enable zero-click remote code execution.
Air reported the Plugin4Shell plugin SHA-pinning bypass vulnerability to Anthropic, OpenAI, Google, and Microsoft in June. The source does not specify a year for the report.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
theregister.com
Open sourceair.security
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Novee Security disclosed at Black Hat USA 2026 that AI coding agents tied to GitHub workflows can be manipulated through untrusted issue, pull request, and workflow-generated content to execute malicious actions inside repositories they are meant to maintain. Testing of **Anthropic Claude Code**, **Google Gemini CLI**, and **OpenAI Codex** against the vendors’ own public repositories and default setups showed paths to **remote code execution**, credential theft, repository tampering, and software supply-chain compromise without requiring privileged access. Researchers said the weakness lies primarily in the surrounding agent harnesses—tool permissions, execution controls, and sandboxing—rather than the underlying models. Reported exploitation paths included command-validation bypasses, unenforced shell restrictions, secret exposure through `/proc`, and persistent instruction poisoning across multi-pass workflows. Anthropic remediated **`CVE-2026-54316`** in Claude Code versions `0.2.54` through `2.1.162`; Google patched Gemini CLI versions before `0.39.1`, preview versions before `0.40.0-preview.3`, and `run-gemini-cli` GitHub Action versions before `0.1.22`; OpenAI mitigated Codex workflow risk by isolating agent runs and using read-only environments. The researchers said they found similar insecure patterns in more than 100 public repositories and reported no evidence of malicious exploitation in the wild.
Aug 7, 2026
Researchers at Adversa AI disclosed **GuardFall**, a shell-interpretation bypass that affects 10 of 11 surveyed open-source AI coding and computer-use agents, allowing malicious commands to slip past safety filters. The flaw stems from agents checking raw command text while `bash` later rewrites and evaluates that text through expansion, substitution, and quote handling, enabling decades-old evasion techniques such as quoted token splitting, `$IFS` expansion, command substitution, and encoded pipelines. Adversa reported successful end-to-end exploitation against the production **Plandex** binary and said vulnerable agents include **Hermes, opencode, Goose, Cline, Roo-Code, Aider, Plandex, Open Interpreter, OpenHands, and SWE-agent**, while **Continue** was the only surveyed tool found to substantially mitigate the issue through structural command parsing and recursive analysis. The attack becomes especially dangerous when an agent is induced by untrusted content—such as poisoned **READMEs, Makefiles, MCP server responses, package metadata, or repository configuration files**—to emit commands that are then auto-executed on the user’s host. Adversa warned that successful exploitation could expose **SSH keys, cloud credentials, and files in `$HOME`**, and noted that sandbox protections can disappear when agents are run in documented local-host modes. No public in-the-wild exploitation was reported, but researchers urged users to disable auto-execute features, isolate or redirect `$HOME`, avoid running agents on forked pull requests, audit repository-shipped configs, and adopt tokenize-and-canonicalize command enforcement instead of regex or raw-string blocklists.
Jul 12, 2026
Researchers disclosed a supply-chain weakness in the ClawHub AI plugin registry after finding **23 unauthorized, code-executing plugins** published under official-looking scopes including `@openclaw/` and `@clawhub/`. Manifold Security reported that ClawHub did not consistently reserve those namespaces for legitimate owners across all existing packages, allowing unrelated accounts to publish plugins that appeared to be first-party tools for ClawHub, OpenClaw, and other agent ecosystems. The reviewed plugins were not confirmed to contain malicious code, but they still ran inside agent environments, creating a trust and impersonation risk for users who relied on scope names as proof of authenticity. Several of the exposed plugins carried **high-risk capabilities**, including payment processing, host-level Git execution, configuration export, and access to external APIs, underscoring the potential impact if a malicious actor abused the same gap. After disclosure, ClawHub unlisted all 23 plugins, changed registry handling, and added a dispute process for unauthorized namespace usage. The case highlights broader security gaps emerging in AI tool and plugin registries, where weak publication-time ownership checks can turn official branding cues into a software supply-chain attack surface.
Jun 29, 2026