Zero-click RCE flaw in AI coding agents let attackers swap in malicious plugins

Plugin4Shell is a zero-click remote code execution flaw in how AI coding agents verify plugin code pinned to a specific Git commit SHA. The agents pass the SHA to Git for checkout but never confirm Git actually resolved to that exact commit, letting an attacker who controls a plugin repository publish malicious code under the trusted SHA name, or via Gemini CLI's FETCH_HEAD reference, and have it run with full developer access without any user interaction. Track how vendors patch supply chain flaws like this before pinning plugin versions in your own agent setup, via daily.dev.

Anthropic patched it in Claude Code version 2.1.179, and OpenAI fixed it in Codex version 0.146.0. Google chose not to patch Gemini CLI at all, instead deprecating it and directing users to Antigravity. GitHub has not released a fix for Copilot, arguing that naming restrictions on GitHub-hosted repositories limit the attack surface, though researchers note this doesn't cover plugin marketplaces hosted elsewhere like Bitbucket. Developers deciding whether to keep using Gemini CLI or Copilot plugins can follow patch status updates on daily.dev.

Organizations can reduce exposure through measures like restricting plugin sources or monitoring repository changes, but the researchers who disclosed Plugin4Shell state clearly that the underlying validation flaw must be corrected by the vendor itself, since it stems from how the agent's code checks out Git commits rather than anything configurable on the enterprise side. Teams weighing risk from unpatched agent plugins can watch for vendor fixes and advisories via daily.dev.