A zero-click RCE flaw in AI coding agents could have exposed enterprise systems
Researchers disclosed Plugin4Shell, a zero-click RCE in Claude Code, Codex, Gemini CLI, and Copilot caused by unverified Git plugin checkouts.
65
- Mentions · 7d0
- Mentions · 30d0
- All mentions3
- First seenSep 17, 2026
- Last mentionedSep 18, 2026
Timeline
3 articles · newest firstZero-click RCE vulnerability hit four major AI coding agents, two remain unpatched
Researchers disclosed Plugin4Shell, a zero-click RCE SHA-pinning bypass in Claude Code, Codex, GitHub Copilot, and Gemini CLI; two remain unpatched.
78
AI coding agents' 0-click RCE flaw could hand attackers keys to the kingdom
Researchers disclosed Plugin4Shell, a zero-click RCE in major AI coding agents' plugin SHA-pinning; Anthropic and OpenAI patched, Microsoft and Google did not.
74
Appears with
- Anthropicvendor · 3
- Microsoftvendor · 3
- Claude Codeproduct · 3
- Googlevendor · 3
- OpenAIvendor · 3
- Gemini CLIproduct · 3
- GitHubvendor · 3
- Codexproduct · 3
- GitHub Copilotproduct · 3
- Antigravityproduct · 2
- Bitbucketvendor · 1
- Microsoft Copilotproduct · 1
- Bitbucketproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.