A zero-click RCE flaw in AI coding agents could have exposed enterprise systems
Researchers disclosed Plugin4Shell, a zero-click RCE in Claude Code, Codex, Gemini CLI, and Copilot caused by unverified Git plugin checkouts.
Researchers at AIR found that AI coding agents pass Git commit SHAs to check out plugins without verifying Git actually checked out the reviewed commit, letting attackers who control a plugin repository serve malicious code instead. Claude Code 2.1.179 and Codex 0.146.0 are patched; Google deprecated Gemini CLI without a fix, and GitHub Copilot remains unpatched. The zero-click attack, discovered in May and disclosed to vendors in June, could expose source code, API keys, cloud credentials, and CI/CD systems in enterprise environments.
- Agents pass plugin commit SHAs to Git without verifying the checkout
- Attackers controlling a plugin repository can serve malicious code instead
- Claude Code 2.1.179 and Codex 0.146.0 patched; Copilot unpatched
- Could expose source code, API keys, cloud credentials, and CI/CD systems
- Organizations
- AIR
From the original article
4 min read at csoonline.com
Popular AI coding agents such as OpenAI’s Codex, Anthropic’s Claude Code, Google’s Gemini CLI, and Microsoft-owned GitHub Copilot were vulnerable to a zero-click attack that enabled attackers to execute malicious code, even without developer interaction, by swapping a trusted plugin from an online marketplace for a malicious one, potentially giving them a foothold in enterprise development environments.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.