All AI programming agents have a dangerous vulnerability – malicious code runs without user interaction

Cybersecurity experts at AI agent startup Air have discovered a vulnerability that allows arbitrary code execution without user interaction, affecting all major AI agent coding applications: Anthropic Claude Code, OpenAI Codex, Google Gemini CLI, and Microsoft Copilot and Microsoft GitHub Copilot. This vulnerability allows a potential attacker to access all resources and data available to these agents.

Image source: Boitumelo/unsplash.com

The vulnerability, called Plugin4Shell, is “the first attack on the artificial intelligence supply chain.” The attack involved in this scheme was not against the model itself or the software framework of the AI ​​agent, but rather against the trusted marketplace hosting plug-ins for popular AI-based development tools. Such attacks could affect millions of users and PCs. The vulnerability is related to the implementation of the mechanism that links plugins and skills of artificial intelligence agents to market hashes. This is to prevent supply chain attacks: if the public repository is compromised, the AI ​​agent will continue to use verified code with the same hash value as captured during the initial connection, and will not automatically download new malicious code.

The problem is that the AI ​​agent loads the submission specified by the market but does not check whether it contains the code originally assigned to it. An attacker who controls the plug-in repository can replace any code with malicious code, thereby officially complying with the hash binding scheme. As a result, code can be executed remotely without any user interaction – this is achieved through the plug-in’s auto-update feature. When an already committed commit in the source repository is overwritten, the agent plugin is replaced with a malicious version and the AI ​​agent application automatically updates it.

An attacker could exploit this flaw in two scenarios. In the first option, he uploaded a harmless plug-in to a trusted marketplace, inspected the plug-in, and then replaced its contents with malicious code. The second option involves hijacking the legitimate author’s repository and then sending a malicious version to all AI agents with the plugin installed – essentially bypassing the hash-binding protection mechanism designed to prevent this type of supply chain attack.

Anthropic reports that it fixed the vulnerability in versions Claude Code 2.1.179, OpenAI – Codex 0.146.0. Google declined to make a fix for the Gemini CLI, which has been discontinued due to the transition to Anti-Gravity – which is protected from such attacks. GitHub says: “To prevent misuse of commit hashes, GitHub does not allow users to create branch or tag names that resemble commit hashes – this security measure ensures that this vulnerability cannot be exploited on GitHub.”. But Ayre said the measure was not enough as the market could be hosted on other platforms. Microsoft did not respond to the researchers’ message about the discovery of the vulnerability.