Zero-click Plugin4Shell flaw hits every major AI coding agent; Microsoft Copilot unpatched

Every major AI coding agent carries a zero-click remote code execution flaw, and at least one of the biggest is still exposed. Air, a security startup focused on protecting enterprise AI agents, calls the exploit "Plugin4Shell" and describes it as a "first-of-its-kind AI supply-chain attack." It affects Anthropic's Claude Code, OpenAI's Codex, Google's Gemini CLI, Microsoft's Copilot, and Microsoft-owned GitHub Copilot. An attacker who succeeds can reach every asset and piece of data the agent can reach, according to Air researchers Or Nevo, Dor Granat, and Niv Hoffman. The scale is not theoretical: Microsoft says nearly 90 percent of Fortune 500 companies use Copilot.

The vulnerability sits in how agents enforce SHA pinning, the mechanism designed to lock a plugin or skill to an immutable commit hash instead of a mutable tag or branch. The Air researchers describe it as a "plugin SHA-pinning bypass." In their words: "The agent checks out the exact commit the marketplace pinned but never verifies it landed there, so an attacker who controls the plugin's repo makes the checkout resolve to malicious code while the pin still looks honored." The result, they write, is "zero-click remote code execution." Because Claude and Codex automatically update installed plugins by default, an attacker who swaps the pinned upstream commit can deliver malicious code without any user interaction.

Air reported the issue to all four vendors in June. Anthropic patched Claude Code 2.1.179, and OpenAI patched Codex 0.146.0. Google has deprecated Gemini CLI and told Air it will not patch, leaving every existing install vulnerable. Google instead suggests users migrate to its newer Antigravity agentic development environment, which is protected from this attack. Microsoft has not fixed Copilot. A GitHub spokesperson said the attacks do not affect GitHub because "GitHub does not allow users to create branch or tag names that resemble commit SHAs." Air says that mitigation is not sufficient, because marketplaces can be hosted on other platforms such as Bitbucket, and Microsoft Copilot supports marketplaces from those platforms. Air says it reported the issue to Microsoft in June but did not get a response, and Microsoft did not immediately respond to The Register's request for comment.

The attack surface is the plugin marketplace, not the model itself. Air says a successful attack could reach millions of users and machines, because agents pull from trusted repositories. An attacker has two viable routes, according to the researchers. First, submit a benign plugin to a trusted marketplace, pass review, then replace the content with malicious code. Second, hijack a legitimate author's repository and push a malicious version to every agent with the plugin installed, bypassing the SHA pinning safety mechanism built to stop that exact scenario. Both routes exploit the gap between what the pinning check looks like and what it actually verifies. Air says its earlier SkillJacking and RepoJacking proof-of-concept attacks already demonstrated that takeovers happen at scale. "Together, the chain is proven end to end - takeovers happen at scale, and Plugin4Shell defeats the mechanism built to contain them," the researchers wrote.

The timing makes this more than a niche bug report. AI coding agents are becoming standard infrastructure at large companies, and Copilot's 90 percent Fortune 500 penetration means the vulnerability reaches the inner loop of software development at the world's biggest firms. It also shows why agent security cannot be bolted on later: the fix must ship in the agent, not the marketplace or the model. "The fix has to ship in the agent, and updating is the only complete mitigation where one exists," the Air team wrote. For Google, deprecation is not a patch: Gemini CLI users remain vulnerable unless they migrate to Antigravity. For Microsoft, the lack of a patch and the lack of a response leaves Copilot deployments hanging without an official fix. Even where a patch exists, updating is a matter of version verification: an enterprise running Claude Code before 2.1.179 or Codex before 0.146.0 is still exposed.

The strategic stakes for executives come down to supply chain hygiene for a new class of software. The same trust dynamic that has produced breaches in npm, PyPI, and open-source registries is now present in AI agent marketplaces, and a model's own security is irrelevant if the plugin it executes is malicious. With Anthropic and OpenAI patched, Google telling users to migrate, and Microsoft still silent, the responsibility for figuring out which agents are safe falls on the teams deploying them. Air's disclosure shows the threat is proven end to end, not a hypothetical. That makes this not just a vulnerability bulletin but a boardroom checklist item for anyone betting on AI-assisted development.