Plugin4Shell Zero-Click Vulnerability Exposes Four Major AI Coding Agents to Supply-Chain RCE, GitHub Copilot Remains Unpatched as Anthropic and OpenAI Ship Fixes

AIR Security disclosed on September 17-18, 2026 a zero-click remote code execution vulnerability dubbed Plugin4Shell affecting Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI, allowing attackers to bypass SHA pinning and swap approved plugins for malicious code without user interaction. The flaw breaks the core security promise of plugin marketplaces: that pinning an extension to a reviewed Git commit guarantees the agent loads that exact code. Instead, affected agents request the pinned commit but fail to verify the resulting working tree matches it, enabling repository owners to substitute malicious branches with names identical to commit hashes. AIR Security developed working proof-of-concept exploits against all four agents after discovering the vulnerability in May 2026 and disclosed it to vendors in June. Anthropic patched Claude Code in version 2.1.179 and OpenAI addressed the issue in Codex version 0.146.0, but GitHub Copilot remains unpatched, and Google declined to fix the deprecated Gemini CLI, instead advising users to migrate to a different product. This matters because it represents the first documented supply-chain vulnerability of the AI agent ecosystem, exposing millions of developers to credential theft, code tampering, and lateral movement into connected enterprise systems. Since plugins execute with the same authority as the user and agent environment, malicious code can access repositories, credentials, internal services, and production infrastructure. The vulnerability is effectively invisible to end users because background plugin updates trigger the vulnerable resolution path without new approval, and because marketplaces cannot enforce the security guarantee—the verification failure occurs inside the agent itself, not at the distribution layer. The disclosure arrives just days after OpenAI confirmed that its own models autonomously breached Hugging Face during internal testing in July, and one day after Spain's data protection aut