Plugin4Shell

Plugin4Shell is a zero-click, high-severity RCE affecting all four major AI coding agents - Claude Code, Codex, Copilot, and Gemini. In this first-of-its-kind AI supply-chain attack, a trusted plugin is silently swapped for a malicious one and auto-installed past the agent's SHA pinning - a flaw no marketplace can fix, so users must update their agent.

Agent add-ons - the plugins and skills you install into an AI agent - are effectively applications, and enterprises overwhelmingly install them from open community marketplaces rather than a vetted, enterprise-grade one. The agent runs with the full capabilities of the employee operating it: the same access to sensitive data, internal systems, and production environments. Plugins inherit those permissions by default. A malicious plugin therefore does not need to escalate anything: it achieves full remote code execution on the employee's machine and hands an attacker the same reach over the enterprise's crown jewels that the employee has.

This is the third act of a story we have been telling. In The Story of Skills we showed how easy it is to get in: we built a malicious skill, watched it go viral, and seized control of over 26,000 agents - planting your code in a marketplace people trust is not the hard part. In SkillJacking we showed you don't even need to plant anything: 925 skills already in use were hijacked out from under their maintainers, affecting 134,000 agents, by taking over the repositories behind them. The industry's answer to exactly this kind of rug-pull is SHA pinning - review the code at one commit, pin that commit, and trust that the pinned commit is what runs forever after. Plugin4Shell is the story of that boundary failing.

It is a plugin SHA-pinning bypass: the agent checks out the exact commit the marketplace pinned but never verifies it landed there, so an attacker who controls the plugin's repo makes the checkout resolve to malicious code while the pin still looks honored. The result is zero-click remote code execution across Claude Code, Codex, GitHub Copilot, and Gemini CLI.

Enterprises using Air Marketplace and Air Filter were not affected by Plugin4Shell.

Why Plugin4Shell is unique

It is the first supply chain vulnerability of the AI agent ecosystem. agent security work has targeted the model or the agent itself. Plugin4Shell attacks the distribution layer underneath them, the marketplaces through which agent add-ons reach millions of machines.

Zero-click remote code execution. No user interaction of any kind is required. The result is full compromise of the agent and the host it runs on, and with it full access to every asset and every piece of data the agent can reach.

One flaw, and every major lab made it. The same design error sits in every affected agent - not an implementation slip in one product, but a single mistake repeated across the industry, leaving millions of agents vulnerable.

A marketplace cannot fully close this. The pin is resolved inside the agent, so only an agent-side fix restores the guarantee. A marketplace can blunt the branch-name variant by allowing only hosts that reject SHA-shaped names - effectively, GitHub-only - but that bans hosts the agents officially support, and does nothing for Gemini CLI's variant.

Who is affected and what is the impact

Anyone running a major coding agent that installs plugins from a marketplace is exposed. That is Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI. The exposure is not limited to users who install plugins carelessly: the victim only has to have a plugin installed, from a marketplace they trust, that was reviewed and pinned exactly as the security model intends.

Doing the right thing does not protect you. Organizations that go beyond a community marketplace - reviewing plugins and pinning them to a reviewed commit - rely on SHA pinning as their safeguard, and Plugin4Shell quietly nullifies it: review passes, the pin is written, and different code installs. Every downstream vetting process built on pinning inherits the failure.

What makes it 0-click is plugin auto-update. Agents update installed plugins in the background - in Claude Code and Codex this is the default - so when the pinned commit is swapped upstream, a plugin the user already trusts and already has installed is replaced with a malicious version without any user interaction: no install step, no prompt, nothing to notice. The attacker does not need to persuade anyone to install anything new. They only need the benign plugin to already be there.

How it can be exploited

There are two paths, and neither requires the attacker to control the marketplace.

Method 1: publish a plugin, then turn it malicious. The attacker contributes a genuinely benign plugin to a trusted marketplace, passes review, and later swaps its content for a malicious version. Getting a plugin into a top marketplace is not hypothetical - we've already done it (The Story of Skills).

Method 2: hijack a legitimate author's plugin. The attacker takes over the repository behind a plugin someone else wrote and the marketplace already trusts, then exploits Plugin4Shell to force the malicious version onto every agent that has it installed - bypassing the version pinning that exists precisely to stop this. We demonstrated the takeover step in the wild in SkillJacking and RepoJacking. Together, the chain is proven end to end - takeovers happen at scale, and Plugin4Shell defeats the mechanism built to contain them.

The attack, end to end:

The attacker publishes a genuinely benign plugin, pinned at commit aaa...aaa . It passes review.

People install it. Every install is pinned to aaa...aaa , the reviewed, trusted version.

The attacker ships a routine update: the marketplace re-pins to a new, still-benign commit bbb...bbb . The pin has changed.

The attacker creates a branch named bbb...bbb , sets it as the repo's default , and points it at malicious code. The pinned commit itself can stay untouched.

The changed pin triggers every agent's background auto-update. The checkout resolves bbb...bbb to the branch - git prefers a ref over a commit of the same name - and it runs. No prompt, no click.

Every affected agent checks out the pinned commit but never checks that it actually landed there. That one missing check is the whole bug - and git gives an attacker two ways to exploit it.

The pinned commit becomes a branch - Claude Code, Codex, GitHub Copilot

These agents clone the plugin repository and check out the pinned SHA:

git clone ./ git checkout aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

The attacker, who now controls the upstream repository, creates a branch whose name is the exact 40-hex pinned SHA and makes it the repository's default, so the plain git clone above brings it down as a local branch of that name. git checkout then resolves the pinned SHA to that branch: when a name is both a valid ref and an object id, git prefers the ref and only prints a refname is ambiguous warning - so it never matters whether the pinned commit is still present, the branch is what gets checked out. Two conditions make it work: nothing blocks a branch from being named like a hash (git's own git check-ref-format accepts 40-hex names, and hosts that follow the protocol accept them too), and the branch must be the repository's default - a non-default branch is fetched only as a remote-tracking ref, and the checkout would fall back to the commit. The working tree is now attacker-controlled, and the agent reports a successful install at the pinned commit.

This is not only an install-time bug, and that is what makes it zero-click: the same git checkout re-runs on background auto-update - the default in Claude Code and Codex - so when the marketplace bumps the pinned SHA, the swap reaches already-installed plugins with no user action.

This only works where a branch can be named like a hash. That is git's default behavior, but some hosts forbid it - GitHub rejects a 40-hex branch name outright - while others, Bitbucket among them, and any self-hosted git server, allow it. Marketplaces on those hosts are a supported configuration; Anthropic's own documentation lists Bitbucket and self-hosted git as valid marketplace backends.

The pin is fetched but never checked out - Gemini CLI

Gemini pins with --ref and installs in three steps:

git clone --depth 1 ./ git fetch origin 41d0bc0a4aeb2fbf797dacea39e876d98c95024b git checkout FETCH_HEAD

The fetch retrieves the correct commit and records it in .git/FETCH_HEAD . But git checkout FETCH_HEAD does not have to read that file: if the repository's default branch is itself named FETCH_HEAD , the checkout resolves to the branch, and the fetched commit is silently discarded in favor of attacker-controlled default-branch content.

One assertion closes both variants: after checkout, resolve the commit actually in the working tree and abort unless it equals the pinned SHA.

test "$(git rev-parse HEAD)" = " " || abort

It has to check the resolved HEAD , not the ref that was requested - that distinction is exactly what the Gemini variant slips through. And it has to run inside the agent: the pin is resolved on the client, so no marketplace can enforce the guarantee it advertises.

How it can be mitigated

Because the pin is resolved inside the agent, no marketplace can enforce it - the fix has to ship in the agent, and updating is the only complete mitigation where one exists:

Claude Code - Anthropic patched it after our disclosure, in 2.1.179.

Codex - OpenAI patched it after our disclosure, in 0.146.0.

GitHub Copilot - we disclosed the same flaw to Microsoft, which has not shipped a fix, so users have no patch.

Gemini CLI - Google has deprecated the Gemini CLI and will not patch it, so every install stays vulnerable for good; those users should migrate to Antigravity, which this attack does not reach - it has no marketplace plugin SHA pinning to bypass.

AIR is Coming Out of Stealth

Today, with enormous excitement, we're announcing that AIR is coming out of stealth. 2026 is the year enterprises went all-in on coding agents. It's also the year they realized they were deploying them without a seatbelt. AIR builds that seatbelt: a firewall for the context AI agents operate in.

AIR is Coming Out of Stealth

Today, with enormous excitement, we're announcing that AIR is coming out of stealth. 2026 is the year enterprises went all-in on coding agents. It's also the year they realized they were deploying them without a seatbelt. AIR builds that seatbelt: a firewall for the context AI agents operate in.

Today, with enormous excitement, we're announcing that AIR is coming out of stealth. 2026 is the year enterprises went all-in on coding agents. It's also the year they realized they were deploying them without a seatbelt. AIR builds that seatbelt: a firewall for the context AI agents operate in.

MCPJacking: 155 Hijackable MCPs Discovered Live in the Official MCP Marketplace

We discovered 155 hijackable MCPs in the official worldwide marketplace used by millions of agents. Each relied on an expired domain, so we simply registered them, published our own MCPs and gained full remote prompt execution on every agent that trusted them. Even official marketplaces carry this supply chain risk, and any enterprise using MCPs is exposed. Enterprises on Air Marketplace are not exposed to MCPjacking.

MCPJacking: 155 Hijackable MCPs Discovered Live in the Official MCP Marketplace

We discovered 155 hijackable MCPs in the official worldwide marketplace used by millions of agents. Each relied on an expired domain, so we simply registered them, published our own MCPs and gained full remote prompt execution on every agent that trusted them. Even official marketplaces carry this supply chain risk, and any enterprise using MCPs is exposed. Enterprises on Air Marketplace are not exposed to MCPjacking.

We discovered 155 hijackable MCPs in the official worldwide marketplace used by millions of agents. Each relied on an expired domain, so we simply registered them, published our own MCPs and gained full remote prompt execution on every agent that trusted them. Even official marketplaces carry this supply chain risk, and any enterprise using MCPs is exposed. Enterprises on Air Marketplace are not exposed to MCPjacking.

AIR and AWS Marketplace

We're excited to that AIR is now listed as "Deployed on AWS" in AWS Marketplace, reflecting our ongoing partnership with AWS.

AIR and AWS Marketplace

We're excited to that AIR is now listed as "Deployed on AWS" in AWS Marketplace, reflecting our ongoing partnership with AWS.

We're excited to that AIR is now listed as "Deployed on AWS" in AWS Marketplace, reflecting our ongoing partnership with AWS.

AIR Is Now Available on Google Cloud Marketplace

Google Cloud customers can now procure AIR through their existing Google Cloud account, with consolidated billing and the ability to draw down on existing Google Cloud committed spend.

AIR Is Now Available on Google Cloud Marketplace

Google Cloud customers can now procure AIR through their existing Google Cloud account, with consolidated billing and the ability to draw down on existing Google Cloud committed spend.

Google Cloud customers can now procure AIR through their existing Google Cloud account, with consolidated billing and the ability to draw down on existing Google Cloud committed spend.

AIR is Coming Out of Stealth

Today, with enormous excitement, we're announcing that AIR is coming out of stealth. 2026 is the year enterprises went all-in on coding agents. It's also the year they realized they were deploying them without a seatbelt. AIR builds that seatbelt: a firewall for the context AI agents operate in.

AIR is Coming Out of Stealth

Today, with enormous excitement, we're announcing that AIR is coming out of stealth. 2026 is the year enterprises went all-in on coding agents. It's also the year they realized they were deploying them without a seatbelt. AIR builds that seatbelt: a firewall for the context AI agents operate in.

Today, with enormous excitement, we're announcing that AIR is coming out of stealth. 2026 is the year enterprises went all-in on coding agents. It's also the year they realized they were deploying them without a seatbelt. AIR builds that seatbelt: a firewall for the context AI agents operate in.

MCPJacking: 155 Hijackable MCPs Discovered Live in the Official MCP Marketplace

We discovered 155 hijackable MCPs in the official worldwide marketplace used by millions of agents. Each relied on an expired domain, so we simply registered them, published our own MCPs and gained full remote prompt execution on every agent that trusted them. Even official marketplaces carry this supply chain risk, and any enterprise using MCPs is exposed. Enterprises on Air Marketplace are not exposed to MCPjacking.

MCPJacking: 155 Hijackable MCPs Discovered Live in the Official MCP Marketplace

We discovered 155 hijackable MCPs in the official worldwide marketplace used by millions of agents. Each relied on an expired domain, so we simply registered them, published our own MCPs and gained full remote prompt execution on every agent that trusted them. Even official marketplaces carry this supply chain risk, and any enterprise using MCPs is exposed. Enterprises on Air Marketplace are not exposed to MCPjacking.

We discovered 155 hijackable MCPs in the official worldwide marketplace used by millions of agents. Each relied on an expired domain, so we simply registered them, published our own MCPs and gained full remote prompt execution on every agent that trusted them. Even official marketplaces carry this supply chain risk, and any enterprise using MCPs is exposed. Enterprises on Air Marketplace are not exposed to MCPjacking.