Zero-click RCE vulnerability hit four major AI coding agents, two remain unpatched

Zero-click RCE vulnerability hit four major AI coding agents, two remain unpatched Four major AI coding agents, Claude Code, Codex, GitHub Copilot and Gemini CLI, all share the same zero-click RCE vulnerability, one that could give an attacker the same reach into a company’s systems and data as the employee running the agent, according to AIR. “It is the first supply chain vulnerability of the AI agent ecosystem,” the researchers said. “Anyone running a major coding agent that installs plugins from a marketplace is exposed. The exposure is not limited to users who install plugins carelessly: the victim only has to have a plugin installed, from a marketplace they trust, that was reviewed and pinned exactly as the security model intends,” they added. How the pinning bypass works The bug, dubbed Plugin4Shell, breaks SHA pinning, the mechanism developers rely on to lock an installed plugin to a specific, reviewed version of its code. Pinning is supposed to mean that once a plugin passes review, it cannot change without the developer’s knowledge. Diagram illustrating the core mechanic of the bug (Source: AIR) AIR’s researchers found that every one of the four agents checks out the pinned commit without verifying the checkout landed there, letting an attacker swap in malicious code while the pin still looks intact. They describe this as a “plugin SHA-pinning bypass.” Claude Code, Codex and GitHub Copilot share one version of it, tied to how git handles branch names. Gemini CLI is exposed through a separate mechanism in how it fetches and checks out pinned commits, though the outcome is the same. The flaw is dangerous because it reaches people who already did everything right. “This is not only an install-time bug, and that is what makes it zero-click: the same git checkout re-runs on background auto-update – the default in Claude Code and Codex – so when the marketplace bumps the pinned SHA, the swap reaches already-installed plugins with no user action.” “This only works where a branch can be named like a hash. That is git’s default behavior, but some hosts forbid it – GitHub rejects a 40-hex branch name outright – while others, Bitbucket among them, and any self-hosted git server, allow it,” AIR wrote. Two ways an attacker gets in In the first, an attacker publishes a plugin that works exactly as advertised. It passes review, users adopt it, and only later does the attacker turn it malicious. AIR said it has already shown this approach works in earlier research, when a plugin it built spread to more than 26,000 agents before being pulled. In the second, an attacker takes over the repository behind a plugin someone else already wrote and users already trust, then uses the same bypass to push malicious code out to everyone who has it installed. AIR demonstrated this kind of takeover separately, in research it calls SkillJacking, where it found 925 skills already in active use had been hijacked from their original maintainers, reaching 134,000 agents. “Together, the chain is proven end to end – takeovers happen at scale, and Plugin4Shell defeats the mechanism built to contain them.” The uneven response from vendors AIR found the bug in May 2026, with working proof-of-concept exploits against all four agents, and disclosed it to each vendor the following month. Since the check runs inside the agent rather than at the marketplace, AIR says no marketplace can guarantee the protection on its own. Closing the gap requires each vendor to fix it in the agent itself, the researchers noted, and updating remains the only complete fix wherever one exists. Anthropic patched Claude Code in version 2.1.179 following AIR’s disclosure. OpenAI patched Codex in version 0.146.0. Microsoft, told about the same flaw in Copilot, has not shipped a fix, leaving its users with no patch. Google has gone further in the other direction, deprecating Gemini CLI altogether rather than patching it, which means every existing install stays exposed indefinitely. Google’s advice to those users is to move to its newer agent, Antigravity, built without the plugin pinning system this attack relies on.