Zero-click RCE vulnerability hit four major AI coding agents, two remain unpatched<\/p>\n
Four major AI coding agents, Claude Code, Codex, GitHub Copilot and Gemini CLI, all share the same zero-click RCE vulnerability, one that could give an attacker the same reach into a company\u2019s systems and data as the employee running the agent<\/p>\n
\u201cIt is the first supply chain vulnerability of the AI agent ecosystem,\u201d the researchers said<\/p>\n
\u201cAnyone running a major coding agent that installs plugins from a marketplace is exposed. The exposure is not limited to users who install plugins carelessly: the victim only has to have a plugin installed, from a marketplace they trust, that was reviewed and pinned exactly as the security model intends,\u201d they added<\/p>\n
The bug, dubbed Plugin4Shell, breaks SHA pinning, the mechanism developers<\/a> rely on to lock an installed plugin to a specific, reviewed version of its code. Pinning is supposed to mean that once a plugin passes review, it cannot change without the developer\u2019s knowledge<\/p>\n Diagram illustrating the core mechanic of the bug<\/p>\n AIR\u2019s researchers found that every one of the four agents checks out the pinned commit without verifying the checkout landed there, letting an attacker swap in malicious code while the pin still looks intact<\/p>\n They describe this as a \u201cplugin SHA-pinning bypass.\u201d Claude Code, Codex and GitHub Copilot share one version of it, tied to how git handles branch names. Gemini CLI is exposed through a separate mechanism in how it fetches and checks out pinned commits, though the outcome is the same<\/p>\n The flaw is dangerous because it reaches people who already did everything right<\/p>\n \u201cThis is not only an install-time bug, and that is what makes it zero-click: the same git checkout re-runs on background auto-update \u2013 the default in Claude Code and Codex \u2013 so when the marketplace bumps the pinned SHA, the swap reaches already-installed plugins with no user action.\u201d<\/p>\n \u201cThis only works where a branch can be named like a hash. That is git\u2019s default behavior, but some hosts forbid it \u2013 GitHub rejects a 40-hex branch name outright \u2013 while others, Bitbucket among them, and any self-hosted git server, allow it,\u201d AIR wrote<\/p>\n In the first, an attacker publishes a plugin that works exactly as advertised. It passes review, users adopt it, and only later does the attacker turn it malicious. AIR said it has already shown this approach works in earlier research, when a plugin it built spread to more than 26,000 agents before being pulled<\/p>\n In the second, an attacker takes over the repository behind a plugin someone else already wrote and users already trust, then uses the same bypass to push malicious code out to everyone who has it installed. AIR demonstrated this kind of takeover separately, in research it calls SkillJacking, where it found 925 skills already in active use had been hijacked from their original maintainers, reaching 134,000 agents.<\/p>\n \u201cTogether, the chain is proven end to end \u2013 takeovers happen at scale, and Plugin4Shell defeats the mechanism built to contain them.\u201d<\/p>\n AIR found the bug in May 2026, with working proof-of-concept exploits against all four agents, and disclosed it to each vendor the following month<\/p>\n Since the check runs inside the agent rather than at the marketplace, AIR says no marketplace can guarantee the protection on its own. Closing the gap requires each vendor to fix it in the agent itself, the researchers noted, and updating remains the only complete fix wherever one exists<\/p>\n Anthropic patched Claude Code in version 2.1.179 following AIR\u2019s disclosure. OpenAI patched Codex in version 0.146.0. Microsoft, told about the same flaw in Copilot, has not shipped a fix, leaving its users with no patch<\/p>\n Google<\/a> has gone further in the other direction, deprecating Gemini CLI altogether rather than patching it, which means every existing install stays exposed indefinitely. Google\u2019s advice to those users is to move to its newer agent, Antigravity, built without the plugin pinning system this attack relies on<\/p>\n More about<\/p>\n \n En rapport:<\/strong> \n Rejoindre Justfine Infotech<\/strong> and build real digital skills in AI, automation, web development<\/a>, digital marketing, office productivity, e-commerce, freelancing and cybersecurity.<\/p>\n Programmes disponibles :<\/strong> WhatsApp :<\/strong>Two ways an attacker gets in<\/h3>\n
The uneven response from vendors<\/h3>\n
\n
\n Formation en automatisation num\u00e9rique au B\u00e9nin\u00a0: 5 comp\u00e9tences cl\u00e9s recherch\u00e9es par les employeurs en 2026
\n <\/a>\n <\/p>\n
\n Automatisation du marketing WhatsApp en Afrique\u00a0: 6 erreurs dangereuses commises par les marques au Nig\u00e9ria
\n <\/a>\n <\/p>\n<\/div>\nVous souhaitez apprendre cela de mani\u00e8re pratique ?<\/h3>\n
\n Certificat de 6 semaines \u2022 Certificat professionnel de 3 mois \u2022 Dipl\u00f4me de 6 mois \u2022 Dipl\u00f4me professionnel complet<\/p>\n
\n +229 01 57 57 99 15
\n +229 01 66 68 11 60<\/p>\n