Plugin4Shell Exposes AI Coding Agents to RCE

AI coding agents like OpenAI's Codex, Anthropic's Claude Code, Google's Gemini CLI, and GitHub Copilot have become indispensable tools in enterprise development environments, automating code generation and modification. But a newly disclosed vulnerability, dubbed Plugin4Shell, could allow attackers to execute malicious code on developer machines without any user interaction, turning these trusted assistants into potential entry points for enterprise breaches.

The flaw, discovered by researchers at cybersecurity startup AIR, affects how these agents verify the integrity of plugins—third-party extensions that add capabilities like access to external services or custom commands. According to a blog post published Thursday, most vendors have released patches, but the incident highlights the risks inherent in the plugin ecosystems that surround AI-powered development tools.

How Plugin4Shell bypasses trust checks

Plugins are essential for extending the functionality of AI coding agents, allowing them to perform tasks beyond simple code generation. When a developer installs a plugin, the agent typically retrieves its code from a Git repository and uses a Git commit hash—a unique cryptographic identifier—to ensure it's running an approved version. This hash, generated by a secure algorithm like SHA, acts as a digital fingerprint for the reviewed code.

The vulnerability arises because agents like Claude Code, Codex, and GitHub Copilot pass the SHA directly to Git to check out the plugin code but fail to verify that Git actually checked out the commit corresponding to that SHA. "That means an attacker who controls the plugin's repository, either by publishing a benign plugin and later turning it malicious or by taking over the repository behind an existing trusted plugin, can exploit the gap by creating a new version of the repository containing malicious code and using the SHA of the legitimate commit as its name," the researchers explained.

When the agent asks Git to check out the SHA, Git resolves it to the attacker-controlled version, causing the agent to execute the malicious code even though it was instructed to use the reviewed commit. This zero-click attack requires no user interaction beyond the initial plugin installation, making it particularly dangerous for enterprises where developers rely on a growing number of third-party plugins.

Gemini CLI's unique attack vector

Gemini CLI, Google's command-line AI coding agent, is vulnerable to a slightly different variant of the attack, though the root cause—the agent's failure to verify Git's checkout—remains the same. According to the researchers, Gemini CLI first uses the SHA to tell Git which legitimate version of the plugin to retrieve. After retrieving it, Gemini CLI tells Git to check out that code using the name "FETCH_HEAD."

An attacker who controls the repository can exploit this by creating a malicious version of the plugin and giving it the same "FETCH_HEAD" name, effectively creating a second version that Git can return when Gemini CLI asks for the code. This manipulation allows the attacker to substitute malicious code for the trusted plugin without triggering any alarms.

The vulnerability was first discovered in May and disclosed to vendors in June. Since then, Anthropic has fixed the issue in Claude Code version 2.1.179, and OpenAI addressed it in Codex version 0.146.0. Google, however, has deprecated the Gemini CLI and will not issue a fix, instead suggesting that users migrate to Antigravity. GitHub has not yet released a fix for Copilot, according to the researchers.

"Enterprises using AI coding agents with third-party plugins are likely to be most exposed, especially when those agents have access to source code, credentials, cloud systems or CI/CD tools as these plugins mostly run with the same access the developer or employee has."

— Pareekh Jain, principal analyst at Pareekh Consulting

GitHub's response and remaining gaps

GitHub, which owns Copilot, told The Register that it has already applied restrictions on creating version or tag names that resemble commit SHAs, preventing the reported vulnerability from being exploited on GitHub or on plugins from its marketplace. However, AIR researchers caution that GitHub's naming restrictions might not be sufficient to thwart Plugin4Shell attacks because plugin marketplaces can also be hosted on other platforms, such as Bitbucket.

This means that even if GitHub's marketplace is secured, attackers could target plugins hosted elsewhere, potentially compromising developers who use multiple sources for their plugins. The fragmented nature of plugin hosting makes it difficult for any single vendor to fully mitigate the risk, leaving enterprises to manage a complex threat landscape.

As of now, GitHub has not released a patch for Copilot, and the researchers noted that the vulnerability could still be exploited through alternative hosting platforms. Enterprises using Copilot should monitor for updates and consider additional safeguards.

Potential impact on enterprise environments

The consequences of a successful Plugin4Shell attack could be severe. Malicious plugins could help attackers access source code, steal API keys or cloud credentials, change repositories, or potentially reach CI/CD and other corporate systems, Jain added. Because these plugins often run with the same privileges as the developer, they can bypass many traditional security boundaries.

"That means that these malicious plugins could help attackers access source code, steal API keys or cloud credentials, change repositories, or potentially reach CI/CD and other corporate systems," Jain said. This access could enable attackers to move laterally within an organization, compromise additional systems, or exfiltrate sensitive data.

Enterprises that have adopted AI coding agents rapidly may not have fully assessed the security implications of plugin usage. The convenience of extending agent capabilities through third-party plugins often outweighs careful scrutiny, creating a broad attack surface that attackers can exploit.

Mitigation steps for security teams

In the wake of the disclosure, security teams should take immediate steps to assess their exposure. "Security teams should examine machines that runs these vulnerable agents. Important warning signs include unusual processes or network connections, unexpected plugin files, changed source repositories, suspicious Git activity and unusual use of developer or cloud credentials," Jain said.

He also recommended that EDR, Git, CI/CD, cloud IAM and authentication logs are good places to investigate. Additionally, organizations should check if their coding agents update automatically to ensure they have received the patches from the vendors that applied it.

However, these steps only reduce the risk and do not fix the underlying vulnerability. "The underlying vulnerability is ultimately a vendor responsibility because it stems from how the agents verify the code they are instructed to execute. They need to ensure that the code being executed is actually the code that was reviewed and approved," Jain said. "Enterprises can put controls around plugin usage, but they cannot fix a flaw in the way the coding agent validates the code it checks out," he added.

For now, enterprises should prioritize updating to the patched versions of Claude Code and Codex, and monitor GitHub for a Copilot fix. Those using Gemini CLI should consider migrating to Antigravity as recommended by Google. Until all vendors address the flaw, the risk remains for organizations that rely on third-party plugins.

Why this matters beyond the patch

The Plugin4Shell vulnerability underscores a broader challenge in the rapidly evolving AI coding agent ecosystem: trust in third-party components is difficult to enforce when the underlying verification mechanisms are flawed. While vendors have patched specific agents, the incident reveals that plugin marketplaces and the agents that consume them may not have robust integrity checks.

For businesses, this means that the adoption of AI coding agents must be accompanied by a security strategy that accounts for plugin risks. Simply installing the latest patches may not be enough if plugins are sourced from multiple repositories or if agents continue to run with elevated privileges. Enterprises should consider restricting plugin usage to vetted sources, implementing strict access controls, and monitoring for anomalous behavior.

The researchers' decision to name the flaw Plugin4Shell evokes the infamous Log4Shell vulnerability, which similarly exploited a widely used component to achieve remote code execution. While Plugin4Shell may not have the same immediate impact, it serves as a reminder that as AI tools become more integrated into development workflows, the security of their extensibility models will be critical. Vendors and enterprises alike must prioritize secure design and continuous vigilance to prevent the next zero-click exploit.