Overview
- Researchers at Air Security found Plugin4Shell in May 2026 and built proof-of-concept exploits that show agents fetch a pinned commit but do not verify the checkout actually landed on that exact commit.
- The technical flaw abuses git behavior where a requested commit SHA can be treated as a branch name on hosts that allow hash-like branch names, and Gemini CLI can be tricked by a FETCH_HEAD-style branch name.
- Background auto-update in some agents makes the bug 'zero-click' because a swapped plugin can propagate silently to already-installed agents without any user action, and prior AIR tests showed such add-ons can spread to tens of thousands of agents.
- Vendor responses are uneven: Anthropic and OpenAI have shipped fixes for Claude Code and Codex respectively, Microsoft has not released a Copilot patch, and Google is deprecating Gemini CLI rather than issuing a fix.
- Full mitigation requires each agent to push a code-side fix and for users to install updates because marketplaces cannot guarantee protection; as of the latest reporting there is no public CVE and no confirmed real-world exploit.