> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # AI coding agents' 0-click RCE flaw could hand attackers keys to the kingdom - URL: https://f4n6.co.uk/security-feed/ai-coding-agents-0-click-rce-flaw-could-hand-attackers-keys-to-the-kingdom/ - Published: 2026-09-18T08:54:19.000Z - Updated: 2026-09-18T08:54:19.000Z - Author: Jeff Davies - Tags: #security-feed ## 1\. Executive summary A zero-click remote code execution flaw, dubbed Plugin4Shell, affects all major AI coding agents: Anthropic Claude Code, OpenAI Codex, Google Gemini CLI, Microsoft Copilot and GitHub Copilot. The flaw is a bypass of the SHA-pinning mechanism that agents use to lock plugins and skills to an immutable commit hash; an attacker who controls a plugin repository can make the checkout resolve to malicious code while the pin still appears honoured, and default plugin auto-update delivers the malicious version without any user interaction. The result is code execution with the full permissions and data access of the agent, which in enterprise deployments typically includes source code repositories, credentials and internal systems. Anthropic patched the flaw in Claude Code 2.1.179 and OpenAI in Codex 0.146.0; Google will not patch the deprecated Gemini CLI, so every install remains vulnerable, and Microsoft has not patched Copilot, which the researchers assess remains exposed via non-GitHub marketplace hosts such as Bitbucket. No CVE, CVSS score or CISA-KEV entry was resolved for this item in our verified reference data, so we assign no numeric severity here; the exposure profile (zero-click, default-on auto-update, agent-level privileges) warrants P1 treatment regardless. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | --------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 24: digital operational resilience testing — general requirements | The vulnerable component is a developer toolchain (AI coding agents with plugin auto-update) that executes code inside the institution's environment, and the only complete mitigation for patched products is an agent update that clients must verify is actually deployed. | Include AI coding agent plugin inventories and marketplace trust configuration in the resilience testing scope; test that pinned-plugin integrity controls hold under a hostile upstream repository. | | NIS2 Art. 21(2)(d): supply chain security measures | The flaw is a supply-chain attack on trusted plugin marketplaces, where a reviewed, benign plugin can be swapped for malicious code upstream of the pin, and one vendor (Google) ships no fix at all. | Treat AI agent plugin marketplaces as supply-chain dependencies in supplier security policy: pin, inventory and review them, and prohibit unpatched agents (Gemini CLI) in production development environments. | No specific DORA/NIS2 article is directly engaged by this item beyond the two rows above. We do not map Art. 19 or NIS2 Art. 23 reporting here: the sources describe a disclosed vulnerability and proof-of-concept chain, not an incident at a client, and a generic "vulnerability exists" trigger would fit every advisory. ## 3\. Technical analysis & attack chain The vulnerability sits in how agents enforce marketplace SHA-pinning. SHA-pinning locks an installed plugin or skill to a specific, immutable commit hash rather than a mutable reference such as a version tag or branch name, so that a compromised public skill repository cannot push new malicious code to already-installed agents. Plugin4Shell breaks that guarantee: the agent checks out the exact commit the marketplace pinned but never verifies that the commit actually landed at that location in the repository. An attacker who controls the plugin's repository can make the checkout resolve to malicious code while the pin still appears honoured. Confirmed attack chain, as described by the researchers: 1. The attacker obtains control of a plugin or skill repository, either by submitting a benign plugin to a trusted marketplace, passing review, and later replacing its content with malicious code, or by hijacking a legitimate author's repository. 2. The attacker manipulates the repository so that the pinned SHA resolves to attacker-controlled code rather than the audited commit. 3. The agent's plugin auto-update feature detects the upstream change and pulls the replacement version. Both Claude Code and Codex automatically update installed plugins by default, which is what makes the attack zero-click. 4. The agent executes the malicious plugin with its own permissions, giving the attacker the same access to assets and data that the agent has. Two attack variants are described. In the first, the malicious content is introduced after marketplace review has already passed. In the second, a legitimate author's repository is hijacked and the malicious version is pushed to every agent that has the plugin installed, defeating the SHA-pinning mechanism that exists to contain exactly this scenario. The researchers state this takeover chain is proven end to end, building on their earlier SkillJacking and RepoJacking proof-of-concept attacks, and that takeovers happen at scale while Plugin4Shell defeats the mechanism built to contain them. Vendor response status, per the source: - Anthropic: patched in Claude Code 2.1.179. - OpenAI: patched in Codex 0.146.0. - Google: Gemini CLI is deprecated and will not be patched; every install remains vulnerable. Google directs users to migrate to its Antigravity agentic development environment, which it says is protected from this attack. - Microsoft: Copilot is not fixed. GitHub states the vulnerability cannot be exploited on GitHub because it does not allow branch or tag names that resemble commit SHAs, but the researchers dispute that this mitigation is sufficient, because marketplaces can also be hosted on other platforms such as Bitbucket, and Microsoft Copilot supports marketplaces from those platforms and is therefore still exposed. Confidence caveat: the vulnerability description, the attack chain and the assessment that GitHub's SHA-name mitigation is insufficient all come from a single vendor report by Air researchers Or Nevo, Dor Granat and Niv Hoffman, relayed via The Register. Air is a security startup with a commercial interest in enterprise AI agent protection. No independent technical confirmation, no CVE record and no observed in-the-wild exploitation are present in the source material. Treat the technical detail as single-sourced; verify before enforcement. ## 4\. Mitigation & containment P1, within 24 hours: - Inventory all AI coding agents in the estate (Claude Code, Codex, Gemini CLI, Microsoft Copilot, GitHub Copilot) and identify which run plugin or skill auto-update. The source confirms auto-update is the default for Claude Code and Codex. - Update Claude Code to 2.1.179 or later and Codex to 0.146.0 or later. The researchers state the fix has to ship in the agent and that updating is the only complete mitigation where one exists. - Disable plugin and skill auto-update on any agent that cannot be updated, in particular Gemini CLI, which will never receive a fix. If auto-update cannot be disabled, remove Gemini CLI from developer machines. - Block or remove plugins and skills sourced from marketplaces hosted outside GitHub (the source names Bitbucket as an example) on Microsoft Copilot, which remains unpatched and, per the researchers, exposed through those hosts. P2, within 72 hours: - Review currently installed plugins and skills for upstream repository changes: confirm that each pinned commit still resolves to the content that was originally reviewed. The source does not provide a tool or command for this check, so treat it as a manual git verification against the pinned SHA. - Restrict agent permissions so that a compromised plugin cannot reach credentials, source code repositories or internal systems beyond what the agent's tasks require. The bottom-line risk in the source is that the attacker gets full access to every asset and piece of data the agent can reach. - Prohibit installation of new plugins from marketplace hosts whose integrity controls are unverified, pending vendor fixes. P3, within 7 days: - Migrate Gemini CLI users to Google's Antigravity environment, which Google states is protected from this attack, or to a patched agent. - Add AI coding agent plugin marketplaces to third-party and supply-chain risk assessments as ongoing dependencies, not one-off reviews, since the first attack variant depends on post-review content replacement. - Track Microsoft's response on Copilot; the researchers reported to Microsoft in June and, per the source, had received no response at publication time. ## 5\. Indicators of compromise No indicators of compromise available in the source material. The sources describe a vulnerability and proof-of-concept attack chain, not a deployed campaign, and provide no hashes, domains, IPs, file paths or other atomic indicators. ## 6\. Detection Insufficient indicators to author detection rules. The source material contains no strings, file names, registry keys, command lines or other artefacts of a malicious plugin that could anchor a YARA or Sigma rule. The only observable it names is behavioural: an installed plugin whose pinned commit resolves to different content upstream. Monitor plugin update logs and git checkouts in agent working directories for pinned-SHA mismatches, and treat any plugin that changes content without a corresponding marketplace review event as suspicious. ## 7\. Sources - The Register, "AI coding agents' 0-click RCE flaw could hand attackers keys to the kingdom", https://www.theregister.com/security/2026/09/17/ai-coding-agents-0-click-rce-flaw-could-hand-attackers-keys-to-the-kingdom/5297335, 2026-09-17\. Reporting on research by Air (Or Nevo, Dor Granat, Niv Hoffman), including statements from GitHub and Google. ## 8\. Adverse Trace position We assess this as a high-priority exposure for EMEA financial services despite the absence of a CVE or CVSS score in our verified reference data, because the affected tools sit inside development environments with broad access to source code and credentials, the attack requires no user interaction on default configurations, and two of the five affected products have no fix at time of writing. The entire technical claim set is single-sourced to Air's report, a vendor with a commercial stake in this problem space, so we are not yet treating exploitation as observed; we have no evidence of in-the-wild use. We will track Microsoft's response on Copilot, any CVE assignment or CISA-KEV listing, and independent reproduction of the SHA-pinning bypass, and we will reissue this advisory if any of those change the exposure picture. Clients should act on the P1 inventory and update steps now rather than wait for corroboration, since the patched versions are available and the unpatched products are identifiable today. --- [Read the original source →](https://www.theregister.com/security/2026/09/17/ai-coding-agents-0-click-rce-flaw-could-hand-attackers-keys-to-the-kingdom/5297335?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*