Plugin4Shell: When Your AI Coding Agent Auto-Updates Straight Into RCE

A critical vulnerability, dubbed Plugin4Shell, has been discovered affecting four major AI coding agents: Claude Code, Codex, Gemini CLI, and Copilot. The flaw lies in the agents' verification process for SHA-pinned plugin commits from marketplaces. When a user installs a plugin, the agent pins it to a specific commit SHA, ensuring the code remains unchanged.

However, this verification process is flawed, allowing attackers to replace a legitimate plugin with malicious code after initial approval or hijack the underlying repository. Since these agents automatically update plugins, the malicious code is executed silently, gaining full access to the agent's filesystem, credentials, CI pipeline, and cloud accounts.

This represents a significant security risk, as agentic coding tools often have broad local and network permissions. The vulnerability stems from a trust-verification gap in the agents' verification process, not a novel exploitation technique. Attackers do not need direct access to the machine; they only need to compromise or spoof the plugin source once, then wait for auto-update to execute the malicious code.

Traditional endpoint security is ineffective against this type of attack, as the agent behaves as expected, performing legitimate operations. Sentinel, an agentic tool abuse detection system, can identify anomalies in plugin behavior, such as unauthorized file reading or network calls, even if the underlying code has been swapped legitimately or maliciously.

Sentinel scans tool calls and tool results in the agentic proxy path, detecting and redacting sensitive information, such as API keys or sensitive strings, that could be used for unauthorized access or data exfiltration. These generic controls on tool-call behavior and tool-result content are applicable to all AI coding agents and help mitigate the risk posed by Plugin4Shell.