Plugin4Shell zero-click RCE hits Claude Code, Codex, Copilot and Gemini CLI days before NIST IR 8587, exposing the gap in agent authorization
docybo · reddit · 2026-09-20
Plugin4Shell supply chain bug
Disclosed Sept 17 by AIR Security: a zero-click RCE affecting Claude Code, Codex, GitHub Copilot and Gemini CLI. Marketplaces pin plugins to a reviewed 40-hex commit SHA, but agents never verify the working tree actually landed on it. An attacker controlling the plugin repo creates a branch named exactly like the pinned SHA and makes it default — when the name is both a valid ref and object ID, git prefers the ref, so checkout lands on attacker code while the pin appears honored.
- Fix: resolve HEAD after checkout and abort on mismatch. Anthropic shipped it in Claude Code 2.1.179, OpenAI in Codex 0.146.0; GitHub Copilot was unpatched at disclosure, and Google said it won't patch the deprecated Gemini CLI.
- Blast radius: malicious code inside a coding agent can reach source code, cloud credentials, SSH keys, internal repos and production systems.
NIST IR 8587's boundaries
Finalized Sept 15 with CISA's JCDC: key management, audience restrictions, shorter token lifetimes, cryptographic binding, revocation, continuous access signals. But API keys are explicitly outside its token model, and authorization of AI agent actions isn't comprehensively addressed — NIST's NCCoE work on agent identity is still at concept stage.
IDC's Yih Khai Wong: "Token hardening assumes the token holder is a known, bounded actor." Agent systems break that assumption.
The open question
A valid credential proves identity or access, but not that this action against this target under current policy was authorized. The author asks: is this solvable with IAM/PDP/PEP done right, or is a missing enforcement primitive still needed between agent access and agent authorization — plus independent post-hoc reconstruction of why an action was allowed, without trusting the agent's own account?
Related event: Plugin4Shell Zero-Click RCE Hits Major Coding Agents(2 posts)→
More from coding & agent
- Claude Skill turns an image's buildings into resizable Three.js models — jasonkneen · 2026-09-20
- Cursor Pro users report credits draining fast and degraded Auto mode, weighing $25/month alternatives — ReporterUnusual9295 · 2026-09-20
- Fuzzing vs property-based testing: the terms are splitting — exploration vs assertion — blaizedsouza · 2026-09-20
- Software factory take: LLMs may generate, but never specify or verify — blaizedsouza · 2026-09-20
- Jev as an NSFW prompt filter: 93% on CSAM evals, sub-cent cost, and where thresholds bite — Murky_Ad8671 · 2026-09-20
- "A heuristic cannot certify a heuristic": why software-factory orchestration thinking is wrong — blaizedsouza · 2026-09-20