Plugin4Shell zero-click RCE in Claude Code, Codex and Copilot exposes the agent authorization gap
docybo · reddit · 2026-09-20
Two developments days apart outline a structural gap in agent security:
Plugin4Shell (AIR Security, disclosed Sept 17)
- Zero-click RCE affecting Claude Code, Codex, GitHub Copilot and Gemini CLI
- Mechanism: marketplaces pin plugins to a reviewed 40-hex commit SHA, but agents never verify the working tree actually landed on it; an attacker creates a branch named exactly like the pinned SHA as default — git prefers the ref, so attacker code is checked out while the pin appears honored
- Fix is trivial: resolve HEAD after checkout and abort on mismatch. Anthropic shipped it in Claude Code 2.1.179, OpenAI in Codex 0.146.0; GitHub Copilot had no fix at disclosure, Google declined to patch the deprecated Gemini CLI
- Blast radius: malicious code inside a coding agent can reach source code, cloud credentials, SSH keys, internal repos and production systems
NIST IR 8587 (finalized Sept 15, with CISA's JCDC)
- Guidance on protecting identity/access tokens: key management, audience restrictions, shorter lifetimes, cryptographic binding, revocation, continuous access signals
- But API keys are explicitly outside its token model, and authorization of AI agent actions isn't comprehensively addressed; NIST's NCCoE agent-identity project is still conceptual
Core argument: "Token hardening assumes the token holder is a known, bounded actor" (Yih Khai Wong, IDC). A valid credential proves identity or access — not that this action against this target under current policy was authorized. The author asks whether correct IAM/PDP/PEP deployment solves this, or whether a missing enforcement primitive sits between an agent having access and being authorized to act.
Related event: Plugin4Shell Zero-Click RCE Hits Major Coding Agents(2 posts)→
More from coding & agent
- mitsuhiko talks agentic coding frustrations at Vienna People of Pi meetup — mitsuhiko · 2026-09-20
- User says Meta's Muse agent booked hotels, cut his cable bill and sold Marketplace items in 3 hours — armand_ruiz · 2026-09-20
- Free design skill file for Lovable promises premium app designs with one drop-in — damienghader · 2026-09-20
- LangChain to host webinar on building better harnesses with Jev — hwchase17 · 2026-09-20
- Jev's real power is multi-stage classification: pairing it with XState for agent workflows — DavidKPiano · 2026-09-20
- Dev builds helmstudio, an MLX-first local launcher for open models on Apple Silicon — janishar · 2026-09-20