060 - Plugin4Shell: Zero-Click RCE Vulnerability

Plugin4Shell is a supply-chain vulnerability disclosed by the security firm Air in September 2026, affecting four of the most widely used AI coding agents: Anthropic's Claude Code, OpenAI's Codex, GitHub Copilot, and Google's Gemini CLI. This episode explains how the flaw breaks Git commit pinning, why that turns a routine plugin update into a path for remote code execution, and what it means that researchers are calling the attack zero-click. Coding agents are supposed to pin an installed plugin to a specific, reviewed Git commit, so a future update runs the exact code a developer approved. Plugin4Shell breaks that guarantee: an attacker who controls the plugin's source repository can create a Git reference that resolves to malicious code while still appearing to match the pinned commit. Because agents like Claude Code and Codex enable automatic plugin updates by default, a previously reviewed and trusted plugin can be silently replaced with attacker-controlled code the next time the agent checks for updates, with no new approval, click, or install action from the developer. The stakes come from what a coding agent can typically reach: source code, local files, Git credentials, environment variables, cloud credentials, APIs, and command execution, depending on the agent's permissions and sandboxing. A successful exploit can hand an attacker the same access as the developer running the agent. The episode covers patch status as of the September 17, 2026 disclosure: Anthropic fixed Claude Code in version 2.1.179, and OpenAI fixed Codex in version 0.146.0. GitHub had not shipped a fix for Copilot, and Google said Gemini CLI is being deprecated and will not receive a patch, pointing users toward Antigravity instead. It closes on a broader lesson: a pinning or version-verification system only protects you when it's actually checked, and AI coding agents add a new, high-permission layer to a supply-chain risk that package managers, browser extensions, and IDE plugins already carried. The "zero-click" label is conditional: it requires an attacker to control or compromise the plugin's trusted source repository, with the vulnerable update path enabled. It does not mean every AI agent or every plugin is automatically exploitable. Sources & References Air Security: Plugin4Shell: Zero Click RCE Vulnerability found in top 4 most popular coding agents — https://www.air.security/blog-posts/plugin4shell The Register: AI coding agents' 0-click RCE flaw could hand attackers keys to the kingdom — https://www.theregister.com/security/2026/09/17/ai-coding-agents-0-click-rce-flaw-could-hand-attackers-keys-to-the-kingdom/ Cloud Security Alliance: Plugin4Shell: SHA-Pinning Bypass Enables AI Coding Agent RCE — https://labs.cloudsecurityalliance.org/research/csa-research-note-plugin4shell-ai-coding-agent-supply-chain/ GitHub: OpenAI Codex repository — https://github.com/openai/codex GitHub: Anthropic Claude Code repository — https://github.com/anthropics/claude-code GitHub: Google Gemini CLI repository — https://github.com/google-gemini/gemini-cli Voice narration is AI-generated.