Plugin4Shell zero-click RCE in Claude Code, Codex and Copilot exposes the agent authorization gap
docybo · reddit · 2026-09-20
Two developments days apart outline a structural gap in agent security:
Plugin4Shell (AIR Security, disclosed Sept 17)
- Zero-click RCE affecting Claude Code, Codex, GitHub Copilot and Gemini CLI
- Mechanism: marketplaces pin plugins to a reviewed 40-hex commit SHA, but agents never verify the working tree actually landed on it; an attacker creates a branch named exactly like the pinned SHA as default — git prefers the ref, so attacker code is checked out while the pin appears honored
- Fix is trivial: resolve HEAD after checkout and abort on mismatch. Anthropic shipped it in Claude Code 2.1.179, OpenAI in Codex 0.146.0; GitHub Copilot had no fix at disclosure, Google declined to patch the deprecated Gemini CLI
- Blast radius: malicious code inside a coding agent can reach source code, cloud credentials, SSH keys, internal repos and production systems
NIST IR 8587 (finalized Sept 15, with CISA's JCDC)
- Guidance on protecting identity/access tokens: key management, audience restrictions, shorter lifetimes, cryptographic binding, revocation, continuous access signals
- But API keys are explicitly outside its token model, and authorization of AI agent actions isn't comprehensively addressed; NIST's NCCoE agent-identity project is still conceptual
Core argument: "Token hardening assumes the token holder is a known, bounded actor" (Yih Khai Wong, IDC). A valid credential proves identity or access — not that this action against this target under current policy was authorized. The author asks whether correct IAM/PDP/PEP deployment solves this, or whether a missing enforcement primitive sits between an agent having access and being authorized to act.
Related event: Plugin4Shell Zero-Click RCE Hits Major Coding Agents(2 posts)→
More from coding & agent
- SemiAnalysis: Persistent agents now eat 45% of our AI spend, and Perplexity's harness beats Claude Tags — dylan522p · 2026-11-12
- Ora's Ranker 3.0 grades whether agents can actually use your site; scores drop 40+ points — yenkel · 2026-11-12
- Gemini API Managed Agents now support self-hosted sandboxes, incl. Vercel — steren · 2026-11-12
- Rayline launches ARC, a per-turn model router claiming 90% cost cuts — testingcatalog · 2026-11-12
- Karpathy's llm-wiki: a pattern for building personal knowledge bases with LLM agents — stochasticchasm · 2026-11-12
- Agent self-improvement with frozen weights: failure traces add just 4pp, blind search gets 60% — burny_tech · 2026-11-12