Plugin4Shell: a "zero-click" vulnerability in Claude Code, Codex, Copilot and Gemini CLI plugins, unpatched in the last two
Prepared by Sintelligent with the help of SI. Publication time restored from the build log. . Updated: .
Agents trusted to write and run code are vulnerable not through the model itself but through an ordinary supply chain, and all the major labs independently made the same mistake.
AIR researchers found that all four popular coding agents make the same mistake in plugin verification: they switch to a "pinned" commit but do not check that the switch actually happened. A branch named the same as the commit hash (and in Gemini CLI, a branch called FETCH_HEAD) slips in malicious code, while the agent reports a successful installation. The attack also works during background auto-update, which is enabled by default in Claude Code and Codex, without a single click from the user. Anthropic closed the hole in Claude Code 2.1.179 and OpenAI in Codex 0.146.0; GitHub Copilot is not fixed, and Google, instead of patching Gemini CLI, declared it deprecated and suggested moving to Antigravity. AIR previously demonstrated a malicious plugin that reached 26 thousand agents.