Zero-click RCE flaw hits Claude Code, Codex, Copilot, Gemini CLI

September 18, 2026 at 01:49 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

AIR researchers found a zero-click remote code execution vulnerability, Plugin4Shell, affecting four major AI coding agents: Claude Code, Codex, GitHub Copilot, and Gemini CLI. The flaw bypasses plugin SHA pinning, allowing attackers to inject malicious code into already-installed plugins without user action. Two of the four agents remain unpatched.

Key Facts

AIR identified the vulnerability as Plugin4Shell, a plugin SHA-pinning bypass affecting Claude Code, Codex, GitHub Copilot, and Gemini CLI.
The flaw allows attackers to swap in malicious code while the pinned commit appears intact, enabling zero-click remote code execution.
Two of the four affected AI coding agents remain unpatched.
AIR previously demonstrated a related attack, SkillJacking, where 925 skills were hijacked, reaching 134,000 agents.

Pinning Bypass Mechanism

The vulnerability breaks SHA pinning, which developers use to lock an installed plugin to a specific reviewed version of its code. AIR found that all four agents check out the pinned commit without verifying the checkout landed there, allowing malicious code substitution. Claude Code, Codex, and GitHub Copilot share one variant tied to how git handles branch names, while Gemini CLI is exposed through a separate mechanism in fetching and checking out pinned commits. The attack works where a branch can be named like a hash, which is git's default behavior but is forbidden by GitHub and allowed by Bitbucket and self-hosted git servers.

Attack Vectors

In the first vector, an attacker publishes a plugin that passes review and later turns it malicious, with AIR having shown this approach spreading to more than 26,000 agents in earlier research. In the second vector, an attacker takes over the repository behind an already trusted plugin and pushes malicious code to all users with it installed. AIR demonstrated this takeover in research called SkillJacking, finding 925 skills already in active use had been hijacked from their original maintainers, reaching 134,000 agents.