Plugin4Shell: a zero-click RCE hits all four major coding agents

A zero-click remote code execution flaw has been found in all four major AI coding agents — and the part that should worry enterprises is that doing everything right does not defend against it.

Air, a security startup that guards enterprise AI agents, disclosed Plugin4Shell on September 17: a flaw that turns the plugin marketplaces every coding agent trusts into a delivery vehicle for silent remote code execution. The bug is not in the model and not in the plugin. It is in how the agents enforce SHA pinning — the mechanism that locks an installed plugin to one reviewed, immutable commit hash so that a later compromise of the upstream repository cannot change what runs on your machine.

Every affected agent checks out the pinned commit, then never verifies that the commit actually landed in the working tree. Git gives an attacker two ways to exploit that gap: name a branch to look like a commit hash (GitHub rejects 40-hex branch names, but Bitbucket and self-hosted git servers allow them, and Anthropic's own documentation lists both as valid marketplace backends), or move the repository so the checkout resolves somewhere else entirely. Either way the pin still reads as honored while different code installs.

Auto-update is what makes it zero-click. Claude Code and Codex update installed plugins in the background by default, so once a benign plugin the user already trusts and already reviewed is swapped upstream, the malicious version arrives with no install prompt and nothing to notice. In a controlled demo, Air carried the chain end to end.

The affected agents: Claude Code, OpenAI's Codex, Microsoft Copilot, and Gemini CLI. Air reported the issue to all four vendors in June. Anthropic patched in Claude Code 2.1.179 and OpenAI in Codex 0.146.0. Microsoft did not ship a fix for Copilot; Air said the volume of disclosures it receives is why no response came. GitHub pushed back on the framing, telling The Register the attack does not affect GitHub itself because the platform forbids branch names that resemble commit SHAs — though Air notes Copilot still accepts marketplaces hosted on platforms that permit them.

The exposure is not limited to careless users. An agent runs with the full permissions of the employee operating it — the same access to internal systems, production environments, and sensitive data. Plugins inherit those permissions by default, so a malicious one needs no escalation at all: it lands with whatever the employee already had. That is the entire enterprise risk in one sentence.

Our read: the fix has to ship in the agent, and updating is the only complete mitigation. No marketplace can enforce this — the pin is resolved inside the agent's own checkout logic, so there is nothing the marketplace can check on your behalf. Enterprises that built vendor review, plugin allowlists, and pinned-commit audit trails on top of SHA pinning have to add "was this agent version updated" as a separate row in the spreadsheet, because their existing vetting inherits the failure. Also worth saying plainly: Gemini CLI is on the list even though Google has deprecated it in favor of Antigravity CLI. Deprecated is not patched.

The UN put its statistics behind an AI-native data platform, and its own pilot numbers explain why that mattered. The UN System Data Commons, built with Google, lets users query statistics across UN agencies in natural language and traces every figure back to its original source. Twenty-six UN entities committed to the platform, nearly 20 are live, and the UN wants 80% of the system's statistical datasets on it by 2027. Google.org put $2 million in capacity-building behind the core infrastructure and says the instance is UN-governed, intended to be operated independently by the UN. Google demonstrated an MCP-connected agent pulling several indicators together into charts and written analysis.

The motivating data came from UNICEF: a benchmark running six large language models against more than 133,000 development-indicator questions scored an average accuracy of 21.2%. Roughly three in five answers contained no usable number at all, and when the same models were re-asked the same questions about two days later, those that gave a number both times returned the identical number only about half the time. The working paper is not yet peer-reviewed. UNICEF referrals from ChatGPT answers to its data site rose 67% year over year through September 14, and AI assistants now account for roughly one in ten visits. Google's own caveat is the honest one: authoritative inputs do not make authoritative conclusions, and a human should review before citing.

Cactus Compute released Needle 3, an automation foundation model that ships as a single 8–29 MB binary and is built to be sliced rather than run whole. One set of weights spans every depth from 2 to 20 layers, each depth usable as its own model, so a manufacturer can fine-tune just the 2-layer subnetwork for one product's tools and run it on hardware the full model would never fit on. Cactus reports fine-tuning on DroidCall lifts every subnetwork by 18 to 36 points, and from 4 layers up the tuned model passes DeepSeek V4 Flash starting at 29 million parameters.

The design choice is deliberate: Cactus trades general chat capacity for tool calling and structured extraction on phones, wearables, robots, smart homes, cars, and microcontrollers. For anyone who has priced a smart-home device and found no room in the bill of materials for a GPU, that trade is the interesting part — an intelligence ladder you cut to fit instead of a model you shrink. We covered the other end of this trend yesterday with Bonsai 2 27B puts a 27B model on a laptop in 5.9 GB — same instinct, different rung.

What to watch: whether Microsoft patches Copilot, and whether any marketplace backend — Bitbucket among them — starts rejecting pseudo-hash branch names upstream.

If a vendor reviews a plugin, pins it, and audits the pin, and the attack still lands, what is left for an enterprise security team to actually do? Tell us in the comments.

Sources: Air — Plugin4Shell: zero-click RCE in the top four coding agents · The Register — AI coding agents' 0-click RCE flaw could hand attackers keys to the kingdom · TechCrunch — UN turns to Google to make its global data ready for AI agents · Google — Google and UN system launch new global data platform · UN System Data Commons · Cactus Compute — Needle 3 · cactus-compute/needle (GitHub)