Glonce

Plugin4Shell flaw lets attackers hijack Claude Code, Codex and Copilot plugins

securityThe Glonce editorsThe Register🔥74Glonce rating74Impact70Novelty65Relevance95Surprise70Players40Credibility70
Plugin4Shell flaw lets attackers hijack Claude Code, Codex and Copilot plugins

Air, a security startup that protects enterprise AI agents, disclosed a vulnerability called "Plugin4Shell" that its researchers, Or Nevo, Dor Granat and Niv Hoffman, describe as a first-of-its-kind AI supply-chain attack. Rather than attacking a model or agent directly, it compromises the trusted plugin marketplaces that serve Anthropic's Claude Code, OpenAI's Codex, Google's Gemini CLI, Microsoft's Copilot and GitHub Copilot, potentially granting an attacker access to every asset and piece of data the agent can reach. Air reported the issue to all four vendors in June. Anthropic patched it in Claude Code 2.1.179 and OpenAI in Codex 0.146.0. Google, which has deprecated Gemini CLI, told Air it will not patch the flaw and is instead recommending users migrate to its newer Antigravity development environment, which the article states is not affected. Microsoft has not fixed the flaw in Copilot, a product Microsoft says nearly 90 percent of Fortune 500 companies use; Microsoft had not responded to The Register's request for comment as of publication.

The bug lives in how agents enforce SHA-pinning, the mechanism that locks a plugin or skill to a specific, immutable commit hash so that a later compromise of the public repository cannot silently swap in new code. The researchers found that an agent checks out the exact commit a marketplace pinned but never verifies that the checkout actually landed on that commit, so an attacker who controls the plugin's repository can make the checkout resolve to malicious code while the pin still appears honored, which the researchers call a "plugin SHA-pinning bypass." Because both Claude and Codex automatically update installed plugins by default, swapping the code upstream is enough to push the malicious version to every installed agent with no user action required, making the attack zero-click. Air's researchers describe two ways to exploit it: submitting a benign plugin that passes marketplace review and later replacing its content with malicious code, or hijacking a legitimate author's repository outright and pushing malicious versions to every agent that has it installed, a takeover the team had already demonstrated in earlier proof-of-concept attacks it calls SkillJacking and RepoJacking.

A GitHub spokesperson said Plugin4Shell attacks do not affect GitHub because the platform does not allow users to create branch or tag names that resemble commit SHAs, which the spokesperson said prevents the reported vulnerability from being exploited there. Air's researchers countered that this mitigation is insufficient because plugin marketplaces can also be hosted on other platforms such as Bitbucket, which still leaves Microsoft Copilot exposed since it supports marketplaces on those platforms too; Air said it reported this same point to Microsoft in June but has not received a response, citing the volume of disclosures Microsoft is currently handling.

Key facts

  • Air disclosed "Plugin4Shell," a zero-click remote-code-execution flaw in the plugin marketplaces used by Claude Code, Codex, Gemini CLI, Copilot and GitHub Copilot.
  • The flaw is a SHA-pinning bypass: an agent checks out the commit a marketplace pinned but never verifies the checkout actually landed there, letting a compromised repo serve malicious code while the pin still looks honored.
  • Because Claude Code and Codex auto-update installed plugins by default, a swapped-in malicious commit propagates to every install with no user action, making the exploit zero-click.
  • Anthropic patched it in Claude Code 2.1.179 and OpenAI in Codex 0.146.0; Google will not patch the now-deprecated Gemini CLI, and Microsoft has not fixed Copilot, which Microsoft says nearly 90 percent of Fortune 500 companies use.
  • GitHub says its ban on commit-SHA-like branch or tag names blocks the attack there, but Air's researchers say the same flaw still exposes Copilot through marketplaces hosted on other platforms such as Bitbucket.

Why it matters

This is a supply-chain attack on the plugin ecosystem that has grown up around AI coding agents rather than on the agents' models themselves. Air's researchers call it a first-of-its-kind AI supply-chain attack, and the mechanism it defeats, commit-hash pinning, is precisely the safeguard those marketplaces built to stop this class of compromise. Because the exploit needs no click or action from the developer once a plugin auto-updates, a single compromised repository can reach every installation that trusted it.

Who it affects

Anyone running Claude Code, Codex, Gemini CLI, Copilot or GitHub Copilot with plugins or skills installed from a marketplace is potentially exposed, and the researchers say the approach could compromise millions of users and machines. Microsoft Copilot users are named as a large at-risk population given Microsoft's own figure that nearly 90 percent of Fortune 500 companies use the product, and every Gemini CLI installation remains vulnerable since Google will not patch a tool it has deprecated.

How to use it

Anthropic and OpenAI users should update to Claude Code 2.1.179 or later and Codex 0.146.0 or later, respectively, since the researchers state the fix has to ship in the agent and updating is the only complete mitigation where one exists. Gemini CLI users have no patch coming and Google is directing them to migrate to its Antigravity development environment instead. Copilot and GitHub Copilot users have no vendor fix as of publication; GitHub says its ban on SHA-like branch and tag names blocks the attack on GitHub itself, but Air disputes that this covers Copilot when marketplaces are hosted on platforms such as Bitbucket.

How solid is it

The account is a named vendor disclosure: Air's own researchers, Or Nevo, Dor Granat and Niv Hoffman, are quoted directly describing the mechanism, and the article reports concrete patch version numbers from Anthropic and OpenAI as well as a GitHub spokesperson's on-record response. Air says it reported the flaw to all four vendors in June and that two have patched, which gives the timeline and the technical description real corroboration, though the specific commit-checkout bypass has not been independently verified outside Air's own report.

Risks and caveats

The source does not give Plugin4Shell a CVE identifier or a formal severity score, and it describes proof-of-concept demonstrations, SkillJacking and RepoJacking, rather than confirmed exploitation against real users in the wild. No monetary loss figures are given, only the researchers' statement that the approach could compromise millions of users and machines. Google's reasoning for declining to patch Gemini CLI is not detailed beyond the tool's deprecation, and Microsoft had not responded to The Register's request for comment as of publication, so Microsoft's own account of the risk to Copilot is not in the record.

“The agent checks out the exact commit the marketplace pinned but never verifies it landed there, so an attacker who controls the plugin's repo makes the checkout resolve to malicious code while the pin still looks honored. The result is zero-click remote code execution”

— Nevo, Granat, and Hoffman, Air researchers