Plugin4Shell Hit 26,000 Agents Before Anyone Noticed. Your Coding Agent’s Plugin Store Is the New npm.
A zero-click RCE vulnerability across Claude Code, Codex, Copilot, and Gemini CLI proves that AI coding agent plugin marketplaces have inherited every supply chain attack pattern from package managers, plus some new ones. In May 2026, researchers at Air Security discovered that every major AI coding agent handles plugin updates the same way: it checks out a SHA-pinned commit, but it never…
A zero-click remote code execution (RCE) vulnerability, dubbed Plugin4Shell, affected over 26,000 AI coding agents before it was addressed in May 2026. Claude Code, OpenAI Codex, GitHub Copilot, and Google Gemini CLI were all vulnerable. The exploit stems from the way these agents handle plugin updates. They check out a SHA-pinned commit, but they don't verify that the checked-out code matches that commit.
Attackers can exploit this by creating a branch with the same 40-character hex string as the pinned SHA, tricking the agent into checking out the malicious branch instead. This silent, zero-click attack can retroactively weaponize previously installed plugins, affecting not just the software but potentially the entire CI pipeline.
The vulnerability highlights the pressing need for better security measures in AI coding agent plugin marketplaces, which have adopted supply chain attack patterns from traditional package managers like npm, PyPI, and RubyGems.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
