Plugin4Shell attack affects all the coding agents, researchers say.
The exploit, dubbed “Plugin4Shell,” is a “first-of-its-kind AI supply-chain attack,” according to threat hunters at Air, a security startup focused on protecting enterprise AI agents.
Instead of targeting the model or agent, Plugin4Shell attacks trusted marketplaces that host plugins for coding agents.
Almost 90 percent of Fortune 500 companies use Copilot, according to Microsoft, which also happens to be one of the two that didn’t ship a patch for the flaw.
“The fix has to ship in the agent, and updating is the only complete mitigation where one exists,” Air researchers Or Nevo, Dor Granat, and Niv Hoffman said in a Thursday report.
The Air team reported the security issue to all four vendors in June, and both Anthropic and OpenAI patched it in Claude Code 2.1.179 and Codex 0.146.0, respectively.
Google has deprecated the Gemini CLI and therefore told Air it will not patch, so every install remains vulnerable. Google does, however, suggest users migrate to its newer Antigravity agentic development environment, which is protected from this attack.
The Air researchers said that the GitHub mitigation isn’t enough to defeat Plugin4Shell attacks.
Redmond did not at once respond to The Register ’s request for comment.
Agents’ plugin auto-update feature makes this a zero-click attack. When a pinned commit is swapped upstream, the agent’s plugin gets replaced with a malicious version, and both Claude and Codex automatically update installed plugins by default.
The researchers say an attacker could abuse this flaw in two ways.