A zero-click RCE vulnerability across Claude Code, Codex, Copilot, and Gemini CLI proves that AI coding agent plugin marketplaces have inherited every supply chain attack pattern from package managers, plus some new ones.
In May 2026, researchers at Air Security discovered that every major AI coding agent handles plugin updates the same way: it checks out a SHA-pinned commit, but it never verifies that the checked-out code actually matches that commit.
That gap turned out to be a zero-click remote code execution vulnerability affecting Claude Code, OpenAI Codex, GitHub Copilot, and Google Gemini CLI. They named it Plugin4Shell. Before it was pulled, one proof-of-concept plugin spread to more than 26,000 agents. A parallel campaign called SkillJacking hijacked 925 skills already in active use, affecting 134,000 agents.
Google deprecated Gemini CLI rather than patching it. GitHub Copilot still hasn't issued a fix at disclosure time. And the underlying architecture that made this possible is the same one every agent marketplace uses.
Welcome to the supply chain attack era for AI coding tools.
How Git Reference Resolution Becomes RCE
The exploit is deceptively simple, which is what makes it scary.
Every plugin marketplace pins plugins to a specific git commit SHA. The theory: you approve version a1b2c3d4..., and that exact code runs every time. The SHA is your guarantee of integrity. This is the same model that Dockerfiles use with image digests and that Go modules use with checksums in go.sum.
Except the agents don't actually verify the checkout. They call git checkout <sha>, but git's reference resolution has a priority order. If a branch name exists that matches or partially matches the SHA, git may resolve to the branch instead of the commit. An attacker who controls the plugin repository creates a branch whose name is the 40-character hex string of the pinned SHA. Git finds the branch first, checks out the branch HEAD (which contains the attacker's code), and the agent proceeds as if the pinned commit loaded.
The critical detail: Claude Code and Codex update installed plugins automatically in the background by default. When the marketplace bumps the pinned SHA, the swap reaches already-installed plugins with no user action. Zero-click. Background. Silent.
The Variants Are Instructive
The vulnerability manifests differently across agents, which tells you something about how fragmented the security thinking is:
Claude Code, Codex, Copilot share the branch-name collision variant. Git's default behavior of checking branches before commit SHAs creates the mismatch. The fix is straightforward: verify the checkout target after the checkout completes. Anthropic shipped a fix in Claude Code v2.1.179. OpenAI patched Codex in v0.146.0. GitHub Copilot has not issued a fix.
Gemini CLI has a separate mechanism involving FETCH_HEAD branch naming during checkout operations. The outcome is identical, but the attack path differs. Google's response was to deprecate Gemini CLI entirely rather than patch it. This is the software equivalent of burning down the house to fix a plumbing leak, and it leaves existing users exposed.
GitHub's hosting blocks 40-character hexadecimal branch names, which offers some protection. But Bitbucket, GitLab, and self-hosted Git servers don't have this restriction. If your plugin sources its code from anywhere other than GitHub, the protection doesn't apply.
26,000 Agents in One Campaign
The Air Security team demonstrated the vulnerability's reach with a controlled proof-of-concept. A single malicious plugin spread to over 26,000 agents before the marketplace detected and pulled it. That's not a theoretical attack surface. That's a real distribution number from a research exercise with guardrails.
The SkillJacking campaign is even more concerning. Researchers identified 925 skills already in active production use that had been compromised, affecting 134,000 agents. These weren't new skills planted by attackers. These were existing, trusted skills whose repositories were modified to exploit the checkout verification gap.
Think about that for a second. The plugin you installed three months ago and have been using daily can be retroactively weaponized through its own update mechanism, and your agent will pull the malicious version automatically without telling you.
The npm Parallel Is Exact
If this attack pattern sounds familiar, you've been paying attention to the last decade of software supply chain security. Plugin4Shell maps directly to the attack patterns that plague npm, PyPI, and RubyGems:
Typosquatting becomes skill squatting. In npm, attackers register packages with names similar to popular ones. In agent marketplaces, they register skills with names that match common workflows. The SkillJacking numbers suggest this is already happening at scale.
Dependency confusion becomes plugin confusion. When agents resolve plugins from multiple sources (marketplace, local, git URL), the resolution priority determines which version loads. This is exactly the dependency confusion pattern that burned Microsoft, Apple, and dozens of others in 2021.
Maintainer compromise becomes repository takeover. If an attacker gains push access to a plugin's git repository, they can modify the code that any SHA-pinned checkout retrieves. The plugin marketplace shows the approved SHA. The agent fetches something else.
The difference is that npm packages run in Node.js with whatever permissions your application has. Coding agent plugins run with the agent's permissions, which typically include file system access, shell execution, and network access. A compromised npm package can steal your environment variables. A compromised agent plugin can rewrite your codebase, exfiltrate your SSH keys, and install a backdoor in your CI pipeline.
What the Patch Status Tells You
The vendor response to Plugin4Shell is a useful diagnostic for how seriously each company takes agent security:
Anthropic patched Claude Code within weeks of disclosure. The fix verifies that the checked-out working tree matches the pinned SHA after checkout. This is the correct architectural fix.
OpenAI patched Codex in a similar timeframe. Same approach: post-checkout verification.
Google deprecated Gemini CLI. No patch. Users of the deprecated tool remain exposed until they migrate to whatever Google ships next, assuming Google ships something next.
GitHub has not issued a fix for Copilot at disclosure time. Given that GitHub's own hosting blocks the branch-naming trick, the risk for GitHub-hosted plugins is lower. But Copilot supports plugins sourced from other Git hosts, where the mitigation doesn't apply.
The pattern: the companies that built their coding agents as serious developer tools (Anthropic, OpenAI) treated the vulnerability as serious infrastructure. The company that built its agent as a product feature (Google) abandoned it. The company that owns the largest code hosting platform (GitHub) hasn't responded.
What You Should Do Right Now
If you use any of these coding agents with plugins, here's the immediate checklist:
Update your agent. Claude Code 2.1.179+ and Codex 0.146.0+ include the fix. If you're on an older version, you're exposed.
Audit your plugin sources. List every plugin you have installed, check where each one sources its code, and verify that the repository hasn't been modified since you approved it. If the plugin sources from Bitbucket or a self-hosted server, the GitHub branch-name protection doesn't apply.
Disable automatic updates until you've audited. The zero-click aspect of Plugin4Shell works through auto-update. Disabling it gives you a review window before new versions execute. This trades convenience for control, and right now control is worth more.
Pin to specific forks you control. For critical plugins, fork the repository to your own organization's Git hosting, pin to your fork, and review changes before pulling upstream. This is the same vendor-copy pattern that production Go modules use, applied to agent plugins.
Watch for SkillJacking indicators. If a plugin you've been using suddenly requests new permissions, accesses files it didn't access before, or generates unexpected network traffic, treat it as a compromise indicator, not a feature update.
The Structural Problem
Plugin4Shell is a vulnerability. But the structural problem is that agent plugin marketplaces replicated every design decision from package managers without learning from 15 years of supply chain attacks:
No reproducible builds. No content-addressed storage. No transparent log of plugin modifications. No mandatory code signing. No sandbox isolation between plugins and the host agent. No review process between "someone pushes code" and "26,000 agents execute it."
The Raspberry Pi 5, a Yubikey, and an air-gapped signing ceremony feel like overkill for a coding plugin. They're not. The alternative is trusting a Git branch name as your integrity guarantee, and we just saw how that goes.
The agent marketplace ecosystem has about eighteen months before the first Plugin4Shell-derived supply chain attack hits a production environment and makes the news for the wrong reasons. The tools exist to prevent it. The question is whether the industry will adopt them proactively or reactively.
Going Deeper
If you're running coding agents with plugins and want to lock down the supply chain before the next Plugin4Shell variant lands:
Claude Code for Developers walks through Claude Code's permission model, plugin management, and CLAUDE.md configuration patterns. This is the guide for enforcing security policies at the agent level, including how to control plugin update behavior and verify what your agent actually executes.
Aider + OpenClaw: Offline-First AI Scripting covers building air-gapped, local-first coding setups with 120+ prompt templates and DeepSeek R1/Ollama stacks. If Plugin4Shell has you rethinking whether your coding agent should auto-update from the internet, this is the alternative architecture: agents that work without trusting a remote marketplace.
Paperclip Method: Replace Your Dev Team With Persistent Claude Agents includes the 4-pillar persistent agent framework with explicit trust boundaries, update verification patterns, and the kind of fork-and-pin workflow that directly mitigates the Plugin4Shell attack surface.
Top comments (2)
Dеar User,
Duе tо аn increasе in bot actіvitу on thе рlatfоrm, we requіrе vеrіfу оf уоur aсcоunt.
Рlease lоg in via the link bеlоw:
• bіt.lу/antibot_cheсk
Verіficаted deadlinе - 12 hours.
Sіnсerеly,Dеv Suppоrt
Do not follow any external links! DEV.to uses Sloan for automated messages, this is likely phishing.