{
 "public_id": "AIR-2026-0248",
 "incident_id": "2026-09-air-security-plugin4shell",
 "date_disclosed": "2026-09-17",
 "date_occurred": null,
 "title": "Plugin4Shell: plugin SHA-pinning bypass gives zero-click RCE through background auto-update in Claude Code, Codex, GitHub Copilot and Gemini CLI",
 "class": "responsible_disclosure",
 "attack_surface": "coding_agent",
 "initial_vector": "supply_chain_compromise_plugin_repository",
 "agent_capability_abused": [
  "plugin_auto_update",
  "git_operations",
  "plugin_code_execution"
 ],
 "target_product": "Claude Code; OpenAI Codex; GitHub Copilot; Gemini CLI",
 "target_vendor": "Anthropic; OpenAI; Microsoft/GitHub; Google",
 "autonomy_level": "assistant",
 "impact_realized": false,
 "impact_type": [
  "remote_code_execution",
  "supply_chain_compromise"
 ],
 "blast_radius": "every installation of the four agents that installed any marketplace plugin whose upstream repository an attacker controls or compromises; Copilot and Gemini CLI installs remain exposed",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI04",
   "ASI05"
  ],
  "mitre_atlas": [],
  "labels": [
   "sha_pinning_bypass",
   "git_ref_shadowing",
   "plugin_supply_chain",
   "zero_click",
   "auto_update",
   "cross_vendor",
   "unpatched_at_disclosure",
   "coding_agent"
  ]
 },
 "defense_present": "marketplace SHA pinning of plugin commits (bypassed: the agent checks out the pinned SHA but never verifies the resulting working tree matches it)",
 "defense_bypassed": true,
 "fix_shipped": "partial: Claude Code 2.1.179 (Anthropic confirmed 2026-06-17); Codex 0.146.0 (OpenAI verified 2026-08-12); Google declined to patch Gemini CLI citing deprecation and recommends migrating to Antigravity (2026-08-04); Microsoft shipped no fix for Copilot as of publication",
 "primary_sources": [
  "https://www.air.security/blog-posts/plugin4shell",
  "https://www.theregister.com/security/2026/09/17/ai-coding-agents-0-click-rce-flaw-could-hand-attackers-keys-to-the-kingdom/5297335",
  "https://www.helpnetsecurity.com/2026/09/18/plugin4shell-ai-coding-agents-vulnerability/"
 ],
 "verified_quote": "It is a plugin SHA-pinning bypass: the agent checks out the exact commit the marketplace pinned but never verifies it landed there, so an attacker who controls the plugin's repo makes the checkout resolve to malicious code while the pin still looks honored.",
 "confidence": "high",
 "notes": "Air Security (Or Nevo, Dor Granat, Niv Hoffman), published 2026-09-17; The Register 2026-09-17, Help Net Security 2026-09-18. Mechanism: for Claude Code, Codex and Copilot the install is git clone then git checkout <pinned-sha>; the attacker who controls the plugin's upstream repo creates a branch whose name is the exact 40-hex SHA and makes it the default, and git resolves the ref over the commit id. Gemini CLI variant: git fetch origin <ref> then git checkout FETCH_HEAD, defeated by a default branch literally named FETCH_HEAD. The changed pin triggers each agent's background auto-update, so the malicious plugin code runs with no prompt or click. Attacker need not control the marketplace, only the repository behind a plugin the marketplace already trusts. Discovered May 2026, disclosed to all four vendors June 2026. Air calls it the first supply-chain vulnerability of the AI agent ecosystem. No CVE mentioned on any cited page. The Register additionally states GitHub applied a partial mitigation via SHA restrictions while Microsoft Copilot remains unpatched. Distinct from AIR-2026-0002 (PromptArmor, injected marketplace plugins with hooks, Jan 2026), which concerned malicious plugin content rather than a pin-verification flaw. autonomy_level=assistant: the trigger is the agent's own auto-update routine, not a delegated task or model decision; ambiguity noted.",
 "risk_category": "security_fraud",
 "risk_secondary": [],
 "risk_subcategory": "Supply Chain Compromise",
 "risk_sub_secondary": [
  "Remote Code Execution & Sandbox Escape"
 ],
 "ai_entity": "generative",
 "agency": "ai_as_target",
 "agency_debatable": false,
 "agency_reason": "plugin auto-update plumbing is the flaw; no model decision is involved",
 "vector_family": "malicious_component",
 "vector_detail": "supply_chain_compromise_plugin_repository",
 "guardrail_kind": [
  "unknown"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI04",
 "agent_framework": "unknown",
 "model_provider": "multiple",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "supply_chain_vulnerabilities",
 "eai_domain": "tool_misuse",
 "eai_secondary": [
  "privilege_escalation"
 ],
 "eai_reason": "subcategory: Supply Chain Compromise",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI04 (vector_family=malicious_component); ASI05 (impact=code_exec)",
 "submitted_by": "EAI Internal"
}