> ## Content Index > Fetch the complete content index at: https://www.thecybersignal.com/llms.txt > Use this file to discover other available public pages before exploring further. # "Plugin4Shell" Zero-Click RCE Across Four Major AI Coding Agents: Two Remain Unpatched - URL: https://www.thecybersignal.com/plugin4shell-ai-coding-agents-claude-code-codex-copilot-gemini-cli-2026/ - Published: 2026-09-19T13:00:00.000Z - Updated: 2026-09-23T01:53:52.000Z - Description: One plugin-marketplace swap, four major AI coding agents affected, and two of them still unpatched. Air Security disclosed Plugin4Shell this week, calling it the first supply-chain vulnerability of the AI agent ecosystem. - Author: Nicholas Robert - Tags: Artificial Intelligence (AI), Supply Chain Attack, Vulnerabilities Air Security (AIR) disclosed a zero-click remote code execution flaw on Thursday, September 18, 2026, that affects four widely used AI coding agents at once: Anthropic's Claude Code, OpenAI's Codex, GitHub Copilot, and Google's Gemini CLI. The firm branded the class Plugin4Shell and, in [remarks reported by Help Net Security](https://www.helpnetsecurity.com/2026/09/18/plugin4shell-ai-coding-agents-vulnerability/?ref=thecybersignal.com), called it "the first supply chain vulnerability of the AI agent ecosystem." Two of the four now have fixes. Two do not. The reason this belongs on a defender's desk rather than a researcher's reading list is reach. AIR says a successful swap gives an attacker the "same reach into a company's systems and data as the employee running the agent," because a plugin runs with that person's access. What follows is a read of what AIR documented, the patch matrix as it actually stands, and the checks a team running any of these agents can run today. It is not a walkthrough of how the swap works, and as of disclosure there is no public sign the flaw has been used in a real attack. ## What Air Security Documented AIR reported that all four agents share one weakness in how they install plugins, and that the weakness defeats the exact control meant to keep a reviewed plugin from changing under you. The agents install add-ons called plugins from online marketplaces, and a marketplace locks each plugin to a single reviewed version, a mechanism developers call SHA pinning. Pinning is supposed to mean that once a plugin passes review, it cannot change without the developer's knowledge. AIR found that each of the four agents fetches the pinned version but never verifies that the code it ends up running actually matches it. At a high level, the finding reduces to this: someone who controls a plugin's code repository can swap the plugin an agent installs for a malicious one, even when the agent is locked to a specific reviewed version. AIR says it built working proof-of-concept exploits against all four agents in May 2026 and disclosed the flaw to each vendor the following month. As of September 18, [no CVE identifier had been assigned and none of the four vendors had published a security advisory](https://thehackernews.com/2026/09/plugin4shell-lets-repository-owners.html?ref=thecybersignal.com), according to checks by The Hacker News. The scope claim is the part AIR leans on hardest. "Anyone running a major coding agent that installs plugins from a marketplace is exposed," the researchers [wrote](https://www.air.security/blog-posts/plugin4shell?ref=thecybersignal.com). "The exposure is not limited to users who install plugins carelessly: the victim only has to have a plugin installed, from a marketplace they trust, that was reviewed and pinned exactly as the security model intends." That is the uncomfortable core of the disclosure. The people most exposed are the ones who followed the intended process. ## The Plugin-Swap Zero-Click Mechanism What makes Plugin4Shell a zero-click issue rather than a phishing-style trap is that the victim does not have to click anything, or do anything at all. The swap can reach a plugin a user already installed and trusts, through the background auto-update that keeps installed plugins current. AIR says that background auto-update is the default in Claude Code and Codex, which is why it frames the same underlying bug as an install-time problem and a zero-click one at the same time. I am not going to reconstruct the swap itself. AIR's writeup carries the mechanics, and the operational detail adds nothing a defender needs to act. The load-bearing point sits one level up: the pin a team relies on to freeze a plugin at a reviewed version is not, on its own, a guarantee that the code you run matches the code that was reviewed. My read is that a version pin here should be treated as a statement of intent rather than proof of integrity. The reviewed snapshot and the executed snapshot were assumed to be the same thing, and Plugin4Shell is what happens when that assumption is never checked. ## The Four-Agent Scope and Patch Matrix As of AIR's disclosure, Claude Code and Codex are patched, and Copilot and Gemini CLI are not. Anthropic patched Claude Code in Claude Code 2.1.179, and OpenAI patched Codex in Codex 0.146.0\. OpenAI's [own public fix](https://github.com/openai/codex/pull/34644?ref=thecybersignal.com) describes the same underlying behavior it set out to close. Microsoft, told about the same flaw in Copilot in June, has not shipped a fix, which leaves GitHub Copilot users with no patch. Google has not patched the Gemini CLI either. It is deprecating the tool rather than fixing it and pointing users to Antigravity, its newer agent, which AIR says this attack cannot reach. Because each agent checks the pin on the user's own machine and not at the marketplace, no marketplace can close this for users. The fix has to ship in the agent itself, and updating is the only complete remedy where one exists. | ● Plugin4Shell Patch Matrix Where each of the four affected AI coding agents stands, per Air Security, as of September 18, 2026. | | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Anthropic Claude Code · Patched Fixed in Claude Code 2.1.179, per Air Security. Update to 2.1.179 or later. OpenAI Codex · Patched Fixed in Codex 0.146.0\. Update to 0.146.0 or later. GitHub Copilot · Not Yet Patched Microsoft was notified in June, per Air Security, and has not shipped a fix. No patch available. Google Gemini CLI · Not Yet Patched No fix shipped. Google is deprecating the tool rather than patching it and points users to Antigravity. | | Source: Air Security, Plugin4Shell disclosure, September 18, 2026, as reported by The Hacker News and Help Net Security. Defender summary only. | *Figure: Plugin4Shell patch status across the four affected AI coding agents as of Air Security's September 18, 2026 disclosure. Source: Air Security, via The Hacker News and Help Net Security.* ## The "First Supply-Chain Vulnerability of the AI Agent Ecosystem" Framing AIR's line that this is "the first supply chain vulnerability of the AI agent ecosystem" is a framing worth weighing rather than repeating. It is a strong superlative, and the firm has an interest in the category it named. AIR ties Plugin4Shell to its own earlier research: a fake skill it built that passed security scanners and reached about 26,000 agents by changing an external link after review, and a separate project it calls SkillJacking, in which it says 925 skills already in active use had been hijacked from their original maintainers, reaching 134,000 agents. The argument AIR draws from stringing those together is that the takeover half of the problem is already proven at scale, and Plugin4Shell defeats the mechanism built to contain it. My assessment is that the "first" is debatable and the substance under it is not. Whether or not this is literally the first flaw of its kind, the thing it demonstrates is real: an AI coding agent has become a software distribution channel, and the version pin was the control standing between a reviewed plugin and a swapped one. Strip away the branding and a defender is left with a concrete integrity gap in tools their developers already trust. ## What AI-Coding-Agent Adopters Should Verify If your developers run any of these four agents, priority order is set by the patch matrix, not by how alarming the class name sounds. The work is mostly inventory and updates, and none of it depends on knowing exactly how the swap works. - **Update the two agents that have fixes.** Move Claude Code to 2.1.179 or later and Codex to 0.146.0 or later. These are the only two complete fixes that exist, and updating is the only remedy that fully closes the gap on those agents. - **Evaluate Copilot and Gemini CLI exposure directly, because there is no patch.** Inventory which plugins are installed and from which marketplaces, and weigh disabling nonessential plugins, or turning off plugin auto-update, until a fix ships. For Gemini CLI specifically, factor in that Google is steering users to Antigravity rather than repairing the tool. - **Audit plugin-marketplace usage across the team.** Map which agents are in use, which marketplaces they pull from, and whether installs come from sources you control. The pin was the assurance you were relying on, so treat marketplace provenance as an open question rather than a settled one. - **Contain the blast radius by limiting what a running agent can reach.** Because the reach equals the running user's access, keep long-lived credentials and secrets out of the environments where these agents run, and prefer short-lived, scoped tokens. For teams building the wider program these checks belong to, our [guide to AI security](https://www.thecybersignal.com/ai-security-the-complete-guide/) covers how to fold AI-assisted development into a defensible posture rather than bolting it on after a disclosure like this one. ## Continuation Context Plugin4Shell is the second time this week that the AI coding assistant itself, rather than a public registry a scanner already watches, is the thing that got compromised. Days earlier, Mandiant documented a case in which [an attacker hijacked an AI coding-assistant session and spread the Shai-Hulud worm across about 100 repositories](https://www.thecybersignal.com/mandiant-ai-coding-assistant-hijack-shai-hulud-100-repos-2026/), and a separate strand of reporting this week described researchers turning coding-assistant integrations at Anthropic and OpenAI into a path to employee accounts and GitHub access. The through-line across all of it is the same reframe: the development workflow, not just the registry, is now part of the supply-chain attack surface, and the tools developers trust most are the ones being turned against them. ## Open Questions Several load-bearing facts are still unsettled, and it is worth naming them rather than papering over them. Active exploitation is unconfirmed: as of September 18 there was no public sign the flaw had been used in a real attack, which is an absence of evidence rather than evidence of absence. It is not established whether Microsoft and Google have committed to any patch timeline, given that Microsoft has shipped no fix and Google is deprecating the Gemini CLI outright. It is also unclear whether other agents in the same category, such as Cursor, Windsurf, or Cline, share the weakness, because AIR tested these four and the sources do not speak to the rest. No CVE had been assigned as of disclosure, and the sources do not say whether updating a patched agent removes a plugin that was already swapped or only stops future swaps. Treat each of those as open until a primary source closes it, and act on the checklist in the meantime, because the checklist does not depend on any of the unknowns. ### Primary Documents - [Air Security, Plugin4Shell disclosure](https://www.air.security/blog-posts/plugin4shell?ref=thecybersignal.com) - [The Hacker News, Plugin4Shell Lets Repository Owners Swap Pinned Plugin Code Across Four AI Coding Agents](https://thehackernews.com/2026/09/plugin4shell-lets-repository-owners.html?ref=thecybersignal.com) - [Help Net Security, Zero-click RCE vulnerability hit four major AI coding agents, two remain unpatched](https://www.helpnetsecurity.com/2026/09/18/plugin4shell-ai-coding-agents-vulnerability/?ref=thecybersignal.com) - [OpenAI, Codex fix (pull request), shipped in Codex 0.146.0](https://github.com/openai/codex/pull/34644?ref=thecybersignal.com)