Plugin4Shell: The Zero-Click RCE That Left Copilot and Gemini CLI Exposed

Plugin4Shell is a zero-click remote code execution bug that AIR Security disclosed on September 17, 2026, and it hit four of the biggest names in AI coding: Claude Code, OpenAI's Codex, GitHub Copilot, and Google's Gemini CLI. Two of those four now have a real patch. The other two don't, and one of them never will.

How Plugin4Shell actually works

Every one of these agents lets you install skills, plugins, or sub-agents from a marketplace, and every one of them uses SHA pinning to make sure the code you approved is the code that actually runs. AIR's researchers found that the pin doesn't work the way anyone assumed. As they put it: "The agent checks out the exact commit the marketplace pinned but never verifies it landed there, so an attacker who controls the plugin's repo makes the checkout resolve to malicious code while the pin still looks honored."

In practice, that means a plugin author can pass review with clean code, then quietly rewrite what the pinned commit points to later, or hijack a trusted repo and push a malicious update to it. Because the checkout happens automatically during background updates, nobody has to click install a second time. AIR is calling it the first real supply-chain vulnerability of the AI agent era, and after [OpenAI's own agents got used to flood RubyGems with malicious packages](/blog/openai-s-agents-hit-rubygems-with-thousands-of-malicious-packages-and-nobody-can-agree-on-how-many) earlier this year, that's not much of a stretch.

Who patched, who didn't

AIR gave vendors from June to September before going public, which is normally enough time to ship a fix. Two companies used it.

Microsoft hadn't shipped a Copilot fix by the time this went public. GitHub's own defense (blocking branch or tag names that look like commit SHAs) doesn't help once a marketplace plugin can be hosted somewhere other than GitHub, which AIR's team pointed out directly.

The Gemini CLI "fix" isn't a response to this bug

Most of the coverage this week frames Google's move as its answer to Plugin4Shell: no patch, because the product is dead. That's true, but it gets the timeline backwards. Google announced it was sunsetting Gemini CLI in favor of Antigravity CLI on May 19, 2026, and cut off free and Pro/Ultra support on June 18, the same month AIR was quietly notifying vendors about the bug, three months before Plugin4Shell became public knowledge. Anyone still on a free or Pro Gemini CLI install has been running an orphaned tool with a known, unpatched RCE path since before most people had even heard of the bug. Enterprise customers on paid licenses are the only ones still getting support, and that isn't the same thing as a fix for this specific flaw.

If you're still on Gemini CLI, the honest move is to stop treating "Google will patch it" as a plan and migrate. [Google Antigravity](/tools/google-antigravity) is the tool Google itself is steering people toward, for whatever that's worth given who's asking.

What to actually do this week

• Update Claude Code to 2.1.179 or later, and Codex to 0.146.0 or later. Both fixes are already out.
• If you're on Copilot, hold off installing new plugins or sub-agents from repos you don't control, since there's no patched version to move to yet.
• Retire any Gemini CLI installs you still have running; there's no fix coming for free or Pro accounts.
• Run any plugin, skill, or MCP you're about to install through a scanner before you trust it. AIR's own [free add-on scanner](https://scan.air.security) checks skills, MCPs, plugins, and sub-agents against known-bad patterns before you deploy them, no account required.

Not the first time a "trusted" checkout wasn't

This is the second plugin-layer trust bug to hit AI coding agents in as many months. Our [earlier writeup on the GitSpawn flaw](/blog/a-git-setting-let-attackers-run-code-in-7-ai-coding-agents-before-you-ever-hit-approve) covered a different bug: a git config setting that ran attacker code before any approval prompt. The shape of the failure is the same, though: these agents trust a local or cached state without re-verifying it matches what was actually reviewed. Two unrelated bugs finding the same category of gap within a few months of each other says more about the maturity of agent security models than either bug does on its own.

Patch status isn't the only thing worth checking after a disclosure like this. Check whether "no patch" means "coming soon" or "this product isn't getting one." For Gemini CLI, it was already the second kind of dead before Plugin4Shell even had a name.