Plugin4Shell Zero-Click RCE Affects AI Coding-Agent Plugin Marketplaces

Air disclosed Plugin4Shell, a zero-click remote-code-execution supply-chain flaw in plugin marketplaces used by major AI coding agents. The vulnerability can bypass plugin SHA pinning by causing a repository checkout pinned to an ostensibly immutable commit hash to resolve to attacker-controlled code, allowing a malicious plugin submission—or compromise of a legitimate plugin author's repository—to deliver code to installed agents.

Default plugin auto-updates make exploitation zero-click in Claude Code and OpenAI Codex, potentially granting attackers access to developer environments, source code, credentials, and connected infrastructure. Anthropic and OpenAI patched affected products; Air said Microsoft Copilot remains vulnerable and deprecated Gemini CLI installations will not be patched, while GitHub disputed that its platform can be exploited using the reported technique.