The AI coding plugin you installed might have been replaced by the upstream repository

Plugin4Shell: Four AI Programming Agents Caught in Zero-Click RCE

Air Security has disclosed a vulnerability named Plugin4Shell, affecting four major AI programming agents, including Claude Code.

The attack chain is simple enough to send shivers down your spine: as long as an attacker gains control over a plugin's upstream Git repository, they can replace it with malicious code when your client automatically updates the plugin in the background. Zero-click, no confirmation needed, and absolutely no pop-up windows.

The developer's API keys, source code, and SSH credentials are all stolen the moment the malicious code gains execution privileges.

I. Why Didn't SHA Locking Prevent It?

Developers who use AI programming tools are familiar with this mechanism: the plugin marketplace records the SHA hash of the file when distributing plugins (SHA locking). The client verifies the hash when updating the plugin and rejects the update if the file has been altered.

Plugin4Shell bypassed this line of defence.

Deconstructing the Attack Chain

① An attacker compromises or takes control of a plugin's upstream Git repository
② A new version is released in the repository, with the code replaced by a malicious payload
③ The plugin marketplace pulls the new version from the upstream repository, recalculates, and records the new SHA hash
④ Your client initiates a background automatic update, and both the new hash and the new file pass verification
⑤ The malicious code executes in your development environment — zero-click, no pop-ups

SHA locking protects against "files being tampered with by a man-in-the-middle"; it does absolutely nothing to prevent "the upstream repository itself being malicious". This is a classic pattern of software supply chain attacks, which has now been brought to the plugin ecosystem of AI programming agents.

II. Why is it Exploding Now?

Over the past year, AI programming agents like Claude Code, Cursor, GitHub Copilot CLI, and Windsurf have become daily tools for developers. The plugin ecosystem has exploded alongside them — code inspection, database connection, cloud resource deployment, and API debugging, almost every development scenario has a corresponding plugin.

As the number of plugins grows, two problems immediately arise:

The origins of plugins are mixed and untrustworthy

The background of open-source plugin authors is difficult to verify. Once the author's account of a single-person maintained plugin is stolen, all developers who have installed it will fall victim at the same time.

Development environments hold extremely high privileges

AI programming tools can read code repositories, call APIs, run scripts, and connect to cloud resources. A malicious plugin in this environment effectively gains all of the developer's privileges.

III. Three Other Related Incidents in the Same Period

Plugin4Shell is not an isolated case. Within the same week, issues within the AI programming toolchain erupted collectively:

Codex Dual Sandbox Escape

OpenAI Codex was found to contain two vulnerabilities: Heapjack and Overpatch. After enticing developers to open malicious projects, attackers can exploit V8 heap memory leaks and patch privilege escalation to break through the sandbox, executing arbitrary commands on the host machine and writing persistent backdoors without any pop-ups. Fixed versions: Desktop 26.818.21641+, CLI 0.149.0+.

MemTensor Dual-Repository Worm Poisoning

The npm and PyPI dual repositories of the AI memory framework MemTensor were poisoned simultaneously. The malicious package sckit is a worm written in Go that can run without installation scripts, stealing user credentials and self-replicating to spread.

Hacktron Hijacks OpenAI Employee Accounts via Claude Opus 5

Researchers generated an exploit chain using Claude Opus 5, triggering an RCE via the libheif image parsing vulnerability (CVE-2026-32882) in the Discourse forum. Combined with SSO weaknesses, they hijacked accounts including those of OpenAI employees, gaining access to internal private code repositories.

IV. How Can Developers and Teams Defend Themselves?

1

Upgrade to Fixed Versions

Affected agents like Claude Code should be upgraded to official fixed versions; Codex Desktop should be upgraded to 26.818.21641+ and CLI to 0.149.0+.

2

Turn Off Automatic Plugin Updates in the Background

Switch to manual confirmation for updates. Take a look at the changelog and commit history before each update, and reject any with unfamiliar authors or unusual commits directly.

3

Trust Only Approved Plugin Sources

Enterprise teams should lock down internal plugin marketplace sources that have been approved, prohibiting developers from adding third-party sources. Regularly audit the list of installed plugins.

4

Rotate Keys and Credentials

If you have already used plugins on affected versions, rotate your API keys, SSH credentials, and cloud Access Keys immediately. Once malicious code gains execution privileges, these credentials are already compromised.

V. What Can Cyritex Do?

The core of attacks like Plugin4Shell is that components do not undergo independent security verification before reaching the development environment. SHA locking prevents transmission tampering; it cannot prevent the upstream repository itself from being replaced.

CyriGate Cyritex Software Supply Chain Anti-Poisoning Smart Gateway

Deployed between the external open-source ecosystem and corporate artifact repositories, every component called — including plugins pulled by AI programming tools — must undergo threat intelligence verification before arriving in the development environment. It covers 623,400+ threat records and monitors 2,032,940+ AI Skills across four major platforms in real-time. Local queries take <5ms, cloud fill-ins take <2s, and the shortest time from threat intelligence emergence to protection in place is T+6 hours. The protection checkpoint covers three lines of defence: developer workstations, CI/CD pipelines, and AI programming tools (Claude Code, Cursor, etc.), immediately intercepting known malicious hits.

CyriIntel Cyritex Advanced Persistent Threat Intelligence Smart Platform

Integrating 30+ global intelligence sources, it continuously tracks over 1,000 APT groups and ransomware syndicates. Specialized monitoring for AI Skills covers four major platforms: ClawHub, Anthropic Marketplace, skills.sh, and GitHub/skills. It has identified 350,725 malicious Skills, with a malicious rate of approximately 20%. New poisoning techniques are incorporated into interception rules during their exposure window.

AI programming tools have increased development efficiency by an order of magnitude, but they have also expanded the attack surface from "the code you write" to "every plugin you install". Keep risks out of the repository, prevent hazards from landing — this should become the admission threshold for every team's development environment.