Researchers at Air, a security firm focused on enterprise AI agents, disclosed Plugin4Shell: a zero-click remote code execution vulnerability affecting the four most widely used AI coding agents — Claude Code, Codex, GitHub Copilot, and Gemini CLI. The flaw breaks "SHA pinning," the mechanism development teams rely on to lock a plugin to an exact, reviewed version.
All four agents verify that the installed plugin matches a specific commit (identified by its SHA), but none of them confirm that the checkout actually landed there. The attack exploits the fact that git can prioritize a reference name (branch) that matches a commit hash over the real commit object during checkout. If an attacker controls a branch with that name, the agent can end up installing malicious code while incorrectly reporting that the installation matched the expected, approved SHA.
What makes this zero-click is that Claude Code and Codex update installed plugins in the background by default. The attacker doesn't need to convince anyone to install anything new: they can first publish a legitimate plugin that gains adoption, then later modify the upstream repository so the next automatic update delivers the malicious code. Since these plugins typically inherit the same permissions as the developer running the agent, the potential blast radius includes local source code, cloud credentials, SSH keys, internal repositories, and production systems.
Carlos Montiel is an enterprise AI solutions architect. He implements LLMs, Agents, RAG, and orchestrators for businesses in Guatemala and Latin America. Reach out for a consultation.
Contact Carlos Montiel