A zero-click remote code execution vulnerability called Plugin4Shell has been found lurking inside four of the most widely used AI coding agents in enterprise environments. Claude Code, OpenAI Codex, GitHub Copilot, and Google Gemini CLI were all affected. Two of the four remain unpatched.
The flaw was discovered by researchers at Air Security, who reported it to all four vendors in June 2026. Public disclosure followed in September, via reporting from The Register and Help Net Security.
What Plugin4Shell Actually Does
The attack exploits how AI coding agents handle plugin verification through SHA-pinning. When an agent installs a plugin from its marketplace, it checks out the exact commit that was reviewed and approved. The vulnerability is in what happens next: the agent verifies that the checkout happened, but never confirms that the commit it landed on is actually the one it was supposed to get.
That gap is the opening. An attacker who controls a plugin repository can create a branch whose name matches the plugin’s expected 40-character commit hash. Git can prioritize a matching reference name over the actual commit object during checkout, which means the agent installs the attacker’s malicious code while reporting a successful, legitimate installation.
The victim doesn’t need to do anything. No approval prompt. No reinstall. Just having a plugin installed from a marketplace they trust is enough.
There are two main ways this plays out:
- A developer submits a benign plugin that passes security review, then quietly replaces the repo content with malicious code after approval
- A legitimate plugin author’s account gets compromised, and the malicious update gets distributed to all users automatically
Patch Status
The response from vendors has been mixed.
Anthropic moved quickly. Claude Code was patched in version 2.1.179. If your team runs Claude Code, this is the version to be on.
OpenAI also patched, fixing the issue in Codex version 0.146.0.
Google has deprecated the Gemini CLI entirely in favour of its Antigravity development environment. The company told Air Security it will not be issuing a patch for the existing tool. Every existing Gemini CLI installation remains vulnerable.
Microsoft has not patched GitHub Copilot, though the company has said it believes platform-specific mitigations prevent exploitation in its environment. That claim has not been independently verified by the researchers who found the flaw.
What This Means for Business
This vulnerability matters beyond developer teams. AI coding agents have spread into enterprise workflows fast. Data teams use them to write Power BI DAX, build Python pipelines, and automate reporting tasks. Operations teams use them for scripting and automation. The attack surface is broader than most organisations realise.
A few things worth acting on immediately:
Audit which AI coding tools your team is running. If anyone has Gemini CLI installed, that needs to go. Google has confirmed it will not be patched.
Verify Claude Code and Codex are on patched versions. Claude Code 2.1.179 or higher, Codex 0.146.0 or higher. Version checks should take minutes.
Review your plugin inventory. The attack works through trusted plugins, not obvious malware. Any plugin that was installed more than a few weeks ago and hasn’t been reviewed recently is worth examining, especially for tools that access file systems, credentials, or network resources.
Treat AI agent plugins like production dependencies. The same supply chain security practices that apply to npm packages or Python libraries apply here. Pinned versions, regular review, and monitoring for unexpected changes.
The Broader Pattern
Plugin4Shell follows a pattern that’s becoming harder to ignore. This is the third major AI coding agent security disclosure in 2026 alone, joining AgentJacking (MCP server exploitation) and GitSpawn (malicious git config injection).
The common thread is that AI agents are powerful enough to execute real work but the security frameworks around them are still maturing. They trust their tools and marketplaces by design, because that’s what makes them useful. The same trust is what makes them exploitable.
For organisations moving AI coding agents into their development workflows, this is worth treating as a governance question, not just a patching exercise. Which agents are approved? Who can install plugins? What review process applies before a new tool gets enterprise access? Those policies are more valuable than any single patch.
Enterprise DNA’s Omni Ops and Omni Apps services operate AI agents for business workflows. Security review and governance are part of every deployment, which is why incidents like this don’t surprise us. The technology is genuinely useful. But “useful” and “secure by default” are not the same thing yet.
Update your Claude Code and Codex installations now. Remove Gemini CLI. For questions about secure AI agent deployment in your business, talk to the Omni team.