One Plugin Trick Cracks Claude Code, Codex and Gemini CLI

Threat assessment: high. A single zero-click vulnerability hits all four major AI coding agents at once. Claude Code, OpenAI’s Codex, Google’s Gemini CLI and GitHub Copilot share the same flaw, according to The Information. Two vendors have patched. Two have not.

The bug has a name: Plugin4Shell. Security startup Air, which specializes in protecting enterprise AI agents, found it and reported it to all four vendors in June. Public disclosure landed this week. Air calls it a “first-of-its-kind AI supply-chain attack.”

Here’s what stands out to me. This isn’t a jailbreak or a prompt injection. Nobody tricks the model. The attack goes after the plumbing that every coding agent now shares.

What the flaw actually does

All four agents let you install plugins from marketplaces. Skills, hooks, MCP servers, slash commands. The marketplace pins each plugin to a specific git commit hash. That pin is supposed to be your guarantee that you get exactly the code you reviewed.

The problem is simple. The agent checks out the pinned commit but never verifies that the checkout actually landed there. An attacker who controls the plugin’s repository can make the checkout resolve to malicious code while the pin still looks honored. Your terminal says “verified.” Your machine runs the attacker’s code.

Zero clicks required. The user does nothing wrong. They install a plugin they trust from a marketplace they trust, and the agent runs whatever it pulled down.

Why this is worse than a normal bug

Coding agents don’t run in a sandbox. They run as you. That means the attacker inherits everything the agent can reach:

1. Your SSH keys and cloud credentials.
2. API tokens sitting in your shell environment.
3. Every repository on your disk, including private ones.
4. Any CI secret the agent can touch through your workflows.

Air put it bluntly: full access to every asset and piece of data the agent can reach. For a developer at a company with production credentials on their laptop, that’s the keys to the kingdom.

Vendor status report

The responses split cleanly down the middle.

1. Anthropic: Patched. Claude Code 2.1.179 fixes the checkout verification.
2. OpenAI: Patched. Codex 0.146.0 closes the hole.
3. Google: Not patching. Google has deprecated Gemini CLI and told Air it won’t ship a fix. Every existing install stays vulnerable.
4. Microsoft: No fix for Copilot. A GitHub spokesperson said the Plugin4Shell attacks do not affect GitHub itself, which is a narrower claim than “Copilot is safe.”

The Gemini CLI situation deserves attention. Deprecated software doesn’t uninstall itself. Plenty of developers still have it wired into their workflows, and now they’re running a tool with a known, unpatched remote code execution flaw.

Context: the third strike

This is the third time in six months that researchers have found the same class of problem across multiple agents. In April, the “Comment and Control” attacks showed that a malicious GitHub comment could hijack Claude Code, Gemini CLI and Copilot through prompt injection. In August, separate research showed a GitHub issue could leak CI workflow secrets through the same agents.

The pattern is clear. Every major coding agent copied the same architecture: read untrusted input, execute with the user’s full privileges, trust the supply chain by default. When one of them has a bug, they all do.

Orders for the field

If you run any of these tools, here’s your checklist:

1. Update Claude Code to 2.1.179 or later. Update Codex to 0.146.0 or later. Do it today.
2. Audit every plugin you’ve installed. If you don’t recognize the source repo, remove it.
3. If you still use Gemini CLI, treat it as compromised until you’ve stripped all plugins. Better yet, migrate off it.
4. Rotate any credentials that lived in your shell environment while a vulnerable agent was installed.
5. Stop running coding agents with production credentials on the same machine. Separate your dev environment from anything that touches real infrastructure.

My take: plugin marketplaces are the new npm, and we’re about to relive every supply-chain lesson the JavaScript ecosystem learned the hard way. Except this time the packages have shell access and run without asking.

Expect more of these. The agents are shipping features faster than they’re shipping verification. The Information has more on the disclosure and vendor responses.