Plugin4Shell評測：AI編碼代理淪零點擊入侵破口 | Plugin4Shell Review: Zero-Click RCE Hits AI Coding Agents

10月 01, 2026

By Kit 小克 | AI Tool Observer | 2026-10-02

🇹🇼 Plugin4Shell評測：AI編碼代理淪零點擊入侵破口

Plugin4Shell 是 2026 年 9 月由資安公司 Air Security 揭露的零點擊（zero-click）RCE 漏洞，命中四大 AI 寫 code 代理的外掛系統：Claude Code、OpenAI Codex、GitHub Copilot 與 Google Gemini CLI。使用者不用點、不用確認，裝了已驗證的外掛仍可能被偷換成惡意程式碼。

Plugin4Shell 是什麼？

這是一個供應鏈攻擊：代理安裝外掛時記住 SHA 雜湊值當「信任憑證」，但更新時沒真的檢查工作目錄是否停在那個雜湊上。攻擊者掌控外掛庫後，建一個同名分支，代理就會誤以為沒變、實際上已被偷換。

攻擊者能拿到什麼？

Air Security 研究員指出，成功利用 Plugin4Shell 等同拿到開發者帳號的完整權限——原始碼、API 金鑰、CI/CD 憑證、雲端存取權全部可及。

哪些工具中招？修補進度到哪了？

Claude Code：已在 2.1.179 版修補（6月）。
OpenAI Codex：已在 0.146.0 版修補（8月）。
GitHub Copilot：微軟尚未修補——九成 Fortune 500 都在用。
Google Gemini CLI：已棄用不會修，官方建議改用 Antigravity。

開發者該怎麼辦？

確認 Claude Code、Codex 已更新到修補版；Gemini CLI 用戶直接換掉；Copilot 使用者先留意外掛來源，避免裝來路不明的第三方外掛。

評測結論

Plugin4Shell 提醒我們：AI 代理風險不只是模型說謊，外掛供應鏈同樣致命，而且零點擊、使用者毫無犯錯機會。好不好用，試了才知道。

🇺🇸 Plugin4Shell Review: Zero-Click RCE Hits AI Coding Agents

Plugin4Shell is a zero-click remote code execution (RCE) flaw disclosed in September 2026 by security firm Air Security, and it hits the plugin systems of four of the most popular AI coding agents: Claude Code, OpenAI Codex, GitHub Copilot, and Google Gemini CLI. No click, no approval, no confirmation needed — if your agent has an already-trusted plugin installed, an attacker can silently swap it for malicious code.

What Is Plugin4Shell?

At its core, Plugin4Shell is a supply-chain attack: these agents pin plugins to a trusted commit SHA, but never actually verify the working tree landed on that exact commit during updates. An attacker who controls the plugin's repo can create a branch named after that SHA, and the agent checks it out believing nothing changed — while the code underneath has been swapped.

What Can Attackers Actually Get?

According to Air Security researchers Or Nevo, Dor Granat, and Niv Hoffman, a successful Plugin4Shell exploit grants attacker access equivalent to the developer's own account — source code, API keys, CI/CD credentials, and cloud environment access all become reachable.

Which Agents Are Affected, and Are They Patched?

Claude Code: Patched by Anthropic in version 2.1.179, fix confirmed mid-June.
OpenAI Codex: Patched in version 0.146.0, verified mid-August.
GitHub Copilot: Microsoft has not shipped a fix — notable given roughly 90% of Fortune 500 companies reportedly use Copilot.
Google Gemini CLI: Deprecated by Google with no patch coming; users are pointed to Antigravity instead.

What Should Developers Do Right Now?

Check that Claude Code and Codex are running patched versions. If you're still on Gemini CLI, migrate off it. Copilot users currently have no official fix, so vet plugin sources carefully and consider disabling auto-updates for third-party plugins until Microsoft responds.

The Bottom Line

Plugin4Shell is a reminder that AI agent risk isn't just about models hallucinating or lying — the plugin supply chain underneath these tools is just as dangerous, and this flaw required zero user mistakes to exploit. It's not flashy, but it's more consequential than most "AI said something weird" headlines. 好不好用，試了才知道 — you only know if a tool is safe once someone's actually tested it.

Sources / 資料來源

常見問題 FAQ

Plugin4Shell 是什麼等級的漏洞？

這是零點擊遠端程式碼執行（RCE）漏洞，使用者不需任何操作，攻擊者即可透過外掛供應鏈偷換程式碼並執行惡意指令。

哪些 AI 寫 code 工具受影響？

目前確認受影響的是 Claude Code、OpenAI Codex、GitHub Copilot 與 Google Gemini CLI 這四款主流代理工具。

我用的工具修補了嗎？

Claude Code（2.1.179版）與 Codex（0.146.0版）已修補；Copilot 微軟尚未發布修補；Gemini CLI 已被 Google 棄用，不會再修。

一般開發者現在該怎麼防範？

確認版本已更新到修補版、避免安裝來源不明的外掛，Gemini CLI 用戶建議盡快轉換到替代工具如 Antigravity。

Plugin4Shell 有正式 CVE 編號嗎？

截至目前最新報導，尚未有正式 CVE 編號對應此漏洞。

延伸閱讀 / Related Articles

AI 工具觀察站 — 每日精選 AI Agent 與工具趨勢
AI Tool Observer — Daily curated AI Agent & tool trends

搜尋此網誌

AI小貼士