Full Report
Plugin4Shell attack affects all the major coding agents, researchers say
Analysis Summary
# Vulnerability: Plugin4Shell (AI Agent SHA-Pinning Bypass)
## CVE Details
- **CVE ID**: Pending/Not explicitly assigned in provided text (Commonly referred to as "Plugin4Shell").
- **CVSS Score**: Estimated 9.8 - 10.0 (Critical) based on Zero-Click RCE impact.
- **CWE**: CWE-353 (Missing Support for Integrity Check) / CWE-829 (Inclusion of Functionality from Untrusted Control Sphere).
## Affected Systems
- **Products**: AI Coding Agents and associated Plugin Marketplaces.
- **Versions**:
- **Anthropic Claude Code**: Versions prior to 2.1.179 (Vulnerable).
- **OpenAI Codex**: Versions prior to 0.146.0 (Vulnerable).
- **Google Gemini CLI**: All versions (End-of-Life/Deprecated, will not be patched).
- **Microsoft Copilot**: Currently reported as vulnerable (Unpatched).
- **Configurations**: Agents configured to use external plugin marketplaces or repositories where auto-update for plugins/skills is enabled.
## Vulnerability Description
Plugin4Shell is a supply-chain vulnerability originating from a failure in how AI agents verify **SHA-pinning**. SHA-pinning is intended to lock a plugin to a specific, immutable commit hash to prevent malicious updates.
The flaw exists because while the agent requests a specific commit hash from the marketplace/repository, it **fails to verify** that the resulting code checked out actually matches that hash. An attacker who gains control of a plugin repository can manipulate the checkout process to serve malicious code while the agent's environment incorrectly reports that the pinned hash is still being honored.
## Exploitation
- **Status**: PoC available (Demonstrated by Air researchers via "SkillJacking" and "RepoJacking" methods).
- **Complexity**: Low (Exploits automated update mechanisms).
- **Attack Vector**: Network (Supply Chain).
- **Interaction**: Zero-click (Automatic plugin updates trigger the RCE).
## Impact
- **Confidentiality**: Total (Full access to all assets and data the agent can reach).
- **Integrity**: Total (Execution of arbitrary code on the host machine).
- **Availability**: Total (Potential for system takeover or service disruption).
## Remediation
### Patches
- **Anthropic**: Upgrade Claude Code to **v2.1.179** or later.
- **OpenAI**: Upgrade Codex to **v0.146.0** or later.
- **Google**: Migrate from Gemini CLI to the newer **Antigravity** agentic development environment.
### Workarounds
- **Disable Auto-Updates**: If supported, disable the automatic updating of plugins or "skills" within the AI agent settings.
- **Manual Auditing**: Manually verify the local source code of plugins after every update, regardless of the reported SHA pin.
- **Restrict Permissions**: Limit the file system and network permissions granted to AI coding agents to reduce the "blast radius" of an RCE.
## Detection
- **Indicators of Compromise**:
- Discrepancies between the plugin code in the local environment and the official repository's commit history.
- Unexpected outbound network traffic originating from AI agent processes.
- **Detection Methods**:
- File integrity monitoring (FIM) on plugin directories.
- Auditing agent logs for unusual plugin "checkout" or "update" events.
## References
- **Air Security Research**: hxxps[://]www[.]air[.]security/blog-posts/plugin4shell
- **Vimeo PoC (SkillJacking)**: hxxps[://]vimeo[.]com/1206553501
- **Vimeo PoC (RepoJacking)**: hxxps[://]vimeo[.]com/1214324682
- **Google Advisory**: hxxps[://]developers[.]googleblog[.]com/an-important-update-transitioning-gemini-cli-to-antigravity-cli/