Air Security disclosed Plugin4Shell: SHA pinning in Claude Code, Codex, GitHub Copilot, and Gemini CLI plugins can be bypassed, leading to zero-click RCE

Air Security research lab disclosed Plugin4Shell: the plugin version pinning mechanism can be bypassed, causing Claude Code, Codex, GitHub Copilot, and Gemini CLI to load attacker-controlled code, potentially leading to zero-click remote code execution. The research noted that Git reference resolution and plugin checkout logic interpret pinned commits inconsistently, and a malicious publisher can exploit this ambiguity to replace the actually loaded plugin content. Background auto-updates in Claude Code and Codex further expand the risk to installed plugins.