Plugin4Shell評測：AI編碼工具爆零點擊漏洞,2家沒修 | Plugin4Shell Review: 4 AI Coding Agents, 2 Still Unpatched

9月 20, 2026

By Kit 小克 | AI Tool Observer | 2026-09-20

🇹🇼 Plugin4Shell評測：AI編碼工具爆零點擊漏洞,2家沒修

Plugin4Shell是什麼？AI編碼工具史上首個供應鏈漏洞

Plugin4Shell 是資安團隊 AIR Security 在 2026 年 9 月 18 日公布的零點擊遠端執行漏洞（zero-click RCE），影響 Claude Code、OpenAI Codex、GitHub Copilot、Gemini CLI 這四大主流 AI 編碼代理工具。這是目前已知第一起真正打中「AI Agent 外掛生態系」的供應鏈攻擊，因為這些外掛套件通常繼承使用者本機權限，包括原始碼、雲端憑證、SSH 金鑰、內部系統存取權，一旦中招等於直接把鑰匙交給攻擊者。

漏洞原理：SHA Pinning 形同虛設

開發者安裝外掛時通常會用 commit SHA 把版本鎖死，理論上即使外掛作者之後偷改程式碼，本機也只會抓到當初審核過的那一版。但 Plugin4Shell 的問題出在：代理工具雖然「檢查」了 SHA，卻沒有真正驗證 checkout 出來的內容是否真的落在那個 commit 上。換句話說，SHA pinning 這道鎖，鎖是掛著沒錯，門卻沒關緊。

為什麼是「零點擊」？

因為 Claude Code 與 Codex 預設會在背景自動更新已安裝的外掛。攻擊者只要先發布一個看起來正常、能累積使用者口碑的外掛，等到有一定安裝量後，再悄悄改動上游 repo 內容，受害者的代理工具就會在毫無互動的情況下，自動抓進被動過手腳的程式碼並執行。

四家修復進度：兩家還沒補

Claude Code：Anthropic 已在 2.1.179 版修復。
OpenAI Codex：已在 0.146.0 版修復。
GitHub Copilot：尚未修復，官方說法是 GitHub 託管 repo 的命名限制降低了攻擊面。
Gemini CLI：Google 選擇不修，直接宣布終止 Gemini CLI，要用戶改遷移到 Antigravity。

正在用 AI 寫程式的你該做什麼

如果你的團隊有裝任何第三方外掛給 Claude Code、Codex、Copilot 或 Gemini CLI 用，建議立刻做三件事：確認 Claude Code 是否已升級到 2.1.179 以上、Codex 升級到 0.146.0 以上；盤點目前安裝的外掛清單，砍掉不常用或來源不明的；以及暫時關閉外掛自動更新，改成人工審核再更新。Plugin4Shell 這次給整個 AI Agent 生態系上了一課：外掛市集的信任機制，比想像中脆弱。

好不好用，試了才知道。

🇺🇸 Plugin4Shell Review: 4 AI Coding Agents, 2 Still Unpatched

Plugin4Shell: The First Supply Chain Vulnerability to Hit AI Coding Agents

Plugin4Shell is a zero-click remote code execution (RCE) vulnerability disclosed by AIR Security on September 18, 2026, affecting four major AI coding agents: Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI. It's the first real supply-chain attack to land squarely on the AI agent plugin ecosystem — and it matters because these plugins typically inherit the full local permissions of whoever's running the agent: source code, cloud credentials, SSH keys, internal systems. If a plugin gets compromised, so does everything the agent can touch.

How Plugin4Shell Breaks SHA Pinning

Developers pin plugins to a specific commit SHA so that even if an author later tampers with their repo, the local install stays frozen on the reviewed version. Plugin4Shell's flaw is that the agent checks that a SHA is pinned, but never actually verifies the checked-out content matches that commit. The lock looks fastened; the door was never actually shut.

Why "Zero-Click"?

Because Claude Code and Codex auto-update installed plugins in the background by default. An attacker publishes a legitimate-looking plugin, waits for adoption, then quietly modifies the upstream repo. Victims' agents silently pull in the tampered code and execute it — no click, no prompt, no warning.

Patch Status: Two Down, Two Still Exposed

Claude Code: Patched by Anthropic in version 2.1.179.
OpenAI Codex: Patched in version 0.146.0.
GitHub Copilot: Still unpatched — GitHub argues repo naming restrictions limit the attack surface.
Gemini CLI: Google isn't patching it at all — it's deprecating Gemini CLI outright and pushing users to migrate to Antigravity instead.

What to Actually Do About It

If your team runs third-party plugins on any of these tools, do three things now: confirm Claude Code is on 2.1.179+ and Codex is on 0.146.0+; audit your installed plugin list and drop anything unused or from an unverified source; and turn off automatic plugin updates until you can review changes manually. Plugin4Shell is a reminder that the trust model behind AI agent plugin marketplaces is a lot thinner than it looks.

You won't know until you try it.

Sources / 資料來源

延伸閱讀 / Related Articles

AI 工具觀察站 — 每日精選 AI Agent 與工具趨勢
AI Tool Observer — Daily curated AI Agent & tool trends

搜尋此網誌

AI小貼士