Plugin4Shell

A vulnerability dubbed Plugin4Shell has affected four major AI coding agents from different vendors. The flaw allows an attacker to replace trusted plugin code with malicious code while appearing to install the correct version. This occurs due to a missing verification step in the agents' checkout process. Researchers discovered the issue in May 2026 and provided working exploits against Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI.

The agents in question fetch code based on a specific Git commit's SHA hash. However, they fail to verify that the code they retrieve matches the requested commit. Attackers can exploit this by creating a branch with a name identical to the pinned commit hash and making it the default branch, tricking the agents into installing the attacker's code instead.

This vulnerability exposes the agents to the same permissions as the developer using them, potentially gaining access to source code, secrets, cloud environments, production systems, internal services, and enterprise data. While some vendors have patched their agents, others like Google have deprecated the affected tool (Gemini CLI) instead of providing a fix, leaving installations vulnerable.

The marketplace cannot centrally fix the issue, as the verification check occurs within each agent, not at the marketplace level. Therefore, each vendor must address the vulnerability individually by updating the agents to the patched versions. Developers should also review and reduce the permissions and access granted to the agents in their environments.