"The fix has to ship in the agent, and updating is the only complete mitigation where one exists," Air researchers Or Nevo, Dor Granat, and Niv Hoffman wrote in a Thursday report.
Plugin4Shell: a marketplace supply‑chain attack that yields zero‑click RCE
Researchers at Air, a security startup focused on protecting enterprise AI agents, have disclosed a vulnerability they call "Plugin4Shell" that enables zero‑click remote code execution (RCE) across major AI coding agents. Rather than exploiting the models themselves, the attack targets trusted plugin marketplaces. If successful, Plugin4Shell can give attackers full access to "every asset and piece of data that the agent can reach," the team warned, making it a broad supply‑chain pathway into customer environments.
How the SHA‑pinning bypass works
The flaw sits in how agents enforce a marketplace's SHA‑pinning mechanism — a protection that locks plugins to an immutable commit hash instead of a mutable branch or tag. The Air researchers describe a "plugin SHA‑pinning bypass": the agent checks out the pinned commit but "never verifies it landed there," allowing an attacker who controls a plugin repository to make the checkout resolve to malicious code while the pin still appears honored. Because many agents auto‑update installed plugins, the replacement happens without user interaction, producing what the team calls "zero‑click remote code execution."
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildAffected agents and the current patch status
Air tested the exploit against all the major coding agents named in their report: Anthropic’s Claude Code, OpenAI’s Codex, Google's Gemini CLI, Microsoft’s Copilot, and Microsoft‑owned GitHub Copilot. The researchers reported the issue to all four vendors in June. Anthropic and OpenAI have released fixes — Claude Code was patched in version 2.1.179 and Codex in version 0.146.0. Google has deprecated the Gemini CLI and told Air it will not patch that product; Google recommends migrating to its newer Antigravity agentic development environment, which Google says is protected from this attack. Microsoft did not ship a patch for Copilot; Air noted Microsoft was one of two vendors that had not issued fixes.
Two practical attack paths and prior proof‑of‑concepts
The researchers lay out two abuse scenarios. In the first, an attacker submits a benign plugin that passes marketplace review, then later swaps the upstream commit to malicious code. In the second, an attacker hijacks a legitimate author's repository and pushes a malicious revision that propagates to every agent with that plugin installed. Air says the chain is "proven end to end" and points to earlier proof‑of‑concept work it calls SkillJacking and RepoJacking to demonstrate how takeovers can occur at scale.
Vendor responses and disputed mitigations
Not all vendor responses converged. A GitHub spokesperson told reporters that "to prevent abuse of SHAs, GitHub does not allow users to create branch or tag names that resemble commit SHAs," and that this mitigation "ensures the reported vulnerability cannot be exploited on GitHub." Air disputed that as sufficient, noting marketplaces can be hosted on other platforms such as Bitbucket, and that Microsoft Copilot supports marketplaces from such platforms, leaving it exposed. Air also said it had reported the issue to Microsoft since June but — "due [to] the amount of disclosure volume they're currently getting" — did not receive a response; Redmond did not immediately respond to The Register's request for comment.
What this means for technologists, enterprises, and adversaries
- Technologists and security teams: Where a vendor patch exists, applying the agent update is the only complete mitigation, Air says. Teams using Claude Code or Codex should verify they are on the patched versions (Claude Code 2.1.179; Codex 0.146.0). Users of deprecated tools such as Gemini CLI are advised to migrate to Antigravity where possible.
- Affected enterprises and procurement leaders: Microsoft told reporters that "almost 90 percent of Fortune 500 companies use Copilot," a scale that raises exposure if Copilot installations remain unpatched. Organizations must inventory which agents and third‑party marketplaces they rely on, including repositories hosted off GitHub such as Bitbucket, because the attack pathway traverses marketplaces, not only GitHub.
- Adversaries and threat actors: Plugin4Shell offers a high‑leverage supply‑chain avenue: a benign plugin accepted by a marketplace can be swapped or a repository takeover can be weaponized to push malicious commits to many installed agents simultaneously, enabling broad, zero‑click compromise.
Plugin4Shell reframes a familiar truism about software supply chains: locks and pins are only as strong as the verification that enforces them. The Air researchers' finding — and the mixed state of vendor remediation — leaves a narrow window in which attackers can weaponize trusted marketplaces and agent auto‑updates to reach large fleets of developer machines. The immediate questions are factual and urgent: will vendors that have not patched ship fixes, and will large Copilot users expedite agent updates or migrations? Until those actions arrive, Air's blunt advice stands: the complete mitigation must be delivered in the agent and applied by users.
