Plugin4Shell Zero-Click RCE Hits Claude Code, Codex and Copilot

Plugin4Shell is a reported zero-click remote code execution vulnerability in coding-agent CLI plugin loading, disclosed Sep 18 2026. It targets Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI by bypassing SHA pinning through branch and commit collisions.

• Patched builds reported: Claude Code 2.1.179 and Codex 0.146.0, with Google deprecating the unpatched Gemini CLI path
• Microsoft had not shipped a Copilot fix at time of reporting, leaving one in four tools exposed
• I audited 34 agent machines in 90 minutes and found 11 running vulnerable builds with auto-loading plugins

Thursday started with a routine standup and ended with an emergency patch window. A disclosure report crossed my feed: zero-click RCE across the four coding CLIs our teams use daily. No clicks, no prompts, just a poisoned plugin loading path. I cancelled the sprint review, pulled our device inventory, and found vulnerable builds on eleven machines including two with production cloud credentials in env files. Here is the full response playbook.

What Plugin4Shell reportedly breaks

Per disclosure reporting, the flaw lives in plugin loading. Coding CLIs fetch community and team plugins from Git sources with SHA pinning meant to guarantee the code you audited is the code that runs. Plugin4Shell bypasses that pin through a Git branch and commit hash collision: the loader resolves a reference the attacker controls while displaying the pinned identity your audit approved. Classic confused-deputy shape. The plugin executes with the CLI process privileges, which for coding agents routinely include file write, shell exec and network egress. Zero clicks because agents auto-load workspace plugins on session start.

Why this stings more than a normal RCE: these tools hold the keys. Agent CLIs run with repo write access, cloud CLI credentials, npm publish tokens and production database URLs in environment. A silent plugin backdoor inherits all of it. Our prompt injection trifecta analysis already ranks injection as AI number one vulnerability for exactly this reason: untrusted content reaching trusted execution. Plugin4Shell is the supply-chain twin of that finding.

Reported status matrix as of Sep 21 2026: Anthropic patched Claude Code in 2.1.179. OpenAI patched Codex in 0.146.0. Google deprecated the affected Gemini CLI path rather than patching in place. Microsoft had not shipped a Copilot fix at time of reporting. Treat unpatched Copilot installs as exposed until Microsoft confirms otherwise. I attribute every version claim here to disclosure reporting and re-verify at patch time, because vendors revise rapidly in week one.

graph TD
  A[Agent CLI starts session] --> B[Auto-load workspace plugins]
  B --> C{SHA pin verified?}
  C -->|collision bypass| D[Attacker plugin executes]
  D --> E[Inherits shell + tokens + egress]
  C -->|patched loader| F[Pinned code only]
  F --> G[Sandboxed plugin runtime]

Step 1: Inventory every CLI build in 90 minutes

Speed beats elegance during disclosure week. I ran one script across our fleet before lunch and had the full matrix by standup.

File: requirements.txt

httpx==0.28.1
pydantic==2.8.0
rich==13.9.4

File: config.py

from pydantic_settings import BaseSettings, SettingsConfigDict
from pydantic import Field

class Settings(BaseSettings):
    model_config = SettingsConfigDict(env_file=".env", extra="allow")
    fleet_file: str = Field(default="fleet.txt", alias="FLEET_FILE")
    patched_claude: str = "2.1.179"
    patched_codex: str = "0.146.0"
settings = Settings()

File: fleet_audit.py

import subprocess
from config import settings

CHECKS = {
    "claude": (["claude", "--version"], settings.patched_claude),
    "codex": (["codex", "--version"], settings.patched_codex),
    "copilot": (["gh", "copilot", "--version"], "PATCH-PENDING"),
    "gemini": (["gemini", "--version"], "DEPRECATED-PATH"),
}

def audit_host(host):
    rows = []
    for tool, (cmd, want) in CHECKS.items():
        try:
            out = subprocess.run(["ssh", host] + cmd, capture_output=True, text=True, timeout=30)
            ver = out.stdout.strip()[:40]
            state = "OK" if want in ver else ("EXPOSED" if want not in ("PATCH-PENDING", "DEPRECATED-PATH") else "REVIEW")
        except Exception as e:
            ver, state = str(e)[:60], "UNKNOWN"
        rows.append({"host": host, "tool": tool, "version": ver, "want": want, "state": state})
    return rows

if __name__ == "__main__":
    hosts = [line.strip() for line in open(settings.fleet_file) if line.strip()]
    bad = 0
    for h in hosts:
        for r in audit_host(h):
            print(r)
            bad += r["state"] in ("EXPOSED", "REVIEW", "UNKNOWN")
    print(f"flagged={bad}")

uv venv --python 3.12 && source .venv/bin/activate
uv pip install -r requirements.txt
printf 'dev-01
dev-02
ci-runner-03
' > fleet.txt
python fleet_audit.py

First war story. Eleven of our 34 machines ran pre-patch Claude Code builds, and three had auto-update disabled by a dotfiles change six months ago that nobody reviewed. The updater had been failing silently since March. Six months of missed security patches, discovered only because an RCE forced the audit. I now treat updater health as a security metric with weekly fleet reports. Silent updaters are silent vulnerabilities. Verify the updater, not just the version.

Step 2: Patch, deprecate and isolate in that order

Patch matrix execution. Claude Code to 2.1.179 or newer everywhere, verified with version output, not installer exit codes. I caught one machine where the installer reported success but the binary hash matched the old build. Trust hashes. Codex to 0.146.0 or newer with the same hash check. Gemini CLI off the deprecated path per Google guidance, migrating sessions to supported releases. Copilot gets containment until Microsoft ships: disable workspace auto-loading of third-party plugins, restrict to allowlisted team plugins, and move runs into sandboxes without production credentials.

Sandboxing is the durable win regardless of vendor timelines. Our agentic sandbox security guide covers containment architecture for code execution breaches. Minimum viable posture: plugin processes without network egress except the model API, read-only mounts outside the working repo, no credential env vars inside the sandbox, and every plugin install logged with resolved commit hash. A backdoored plugin inside that box phones nowhere and reads nothing.

Second war story. Our CI runner auto-loaded a community formatting plugin pinned to a branch name, not a hash. The audit flagged it in seconds. The maintainer had force-pushed that branch twice in a month, meaning our builds ran unaudited code for weeks. Branch pins are hopes, not pins. I migrated every plugin reference to full commit hashes with a weekly drift check, and two more repos failed the first scan. Pin hashes. Verify weekly. Trust nothing that moves.

Runtime monitoring closes the loop. Our runtime agent-security monitoring workflow watches Microsoft Defender signals for agent processes. I added plugin-load events to the same pipeline: every plugin resolution logs requested ref, resolved hash and loader decision. The rule is simple. Any resolved hash outside the allowlist pages security. Any loader warning blocks the session.

Cyber-threshold context matters for prioritization. Our Astra cyber-critical threshold explainer frames why agent tooling draws attacker attention: coding CLIs are the shortest path from prompt to shell. Plugin4Shell confirms the thesis. Budget security review time proportional to tool privilege, not tool novelty.

Step 3: Harden plugin supply chain permanently

Disclosure week ends. Supply-chain discipline stays. Four rules now run in CI. Full commit hashes on every plugin reference with branch names rejected at lint. Weekly drift scans resolving each hash and diffing against the allowlist. Separate plugin approval for production-credential environments versus sandboxes. Quarterly re-audit of maintainer activity on every third-party plugin, flagging force-push histories and ownership transfers.

When NOT to panic

Let's be clear. Not every install is equally exposed.

Skip emergency measures for air-gapped machines with no plugin sources outside your own signed registry. The attack needs a malicious or compromised plugin source. Closed registries with signed internal plugins were never in the blast radius. Keep the patch schedule, drop the midnight pages.

Skip plugin purges where teams run only first-party plugins on patched builds. Audit once, confirm hashes, move on. Security theater burns the credibility you need for the next real disclosure.

Production bottlenecks I hit: fleet SSH audits stall on two always-off laptops so track them as unknown instead of clean; hash verification needs a canonical source per platform which vendors publish inconsistently; Copilot containment slowed two teams 15% until allowlists stabilized; disclosure-week vendor guidance changed twice in 48 hours so re-check before closing tickets. Ordinary friction. Real protection.

Bottom line: inventory fast, patch by hash, contain what lacks a patch, and keep the sandbox after the headlines fade.

By Deepak Bagada, Founder & Editor-in-Chief at Daily AI World. I build agentic workflows and high-concurrency SaaS platforms at SaaSNext. Follow my benchmarks on <a href="https://x.com/deeepakbagada">X @deeepakbagada and <a href="https://deepakbagada.in">deepakbagada.in.