Zero-click RCE vulnerability hit four major AI coding agents, two remain unpatched
Researchers disclosed Plugin4Shell, a zero-click RCE SHA-pinning bypass in Claude Code, Codex, GitHub Copilot, and Gemini CLI; two remain unpatched.
AIR researchers found Plugin4Shell in May 2026: all four major AI coding agents check out SHA-pinned plugin commits without verifying the checkout landed there, letting attackers swap in malicious code while the pin appears intact. Background auto-updates in Claude Code and Codex make the attack zero-click, and threat paths include backdooring a legitimate plugin or hijacking a trusted repository, as shown by AIR's SkillJacking research where 925 hijacked skills reached 134,000 agents. Anthropic fixed Claude Code in version 2.1.179 and OpenAI fixed Codex in 0.146.0, while Microsoft has shipped no Copilot fix and Google deprecated Gemini CLI without patching, directing users to Antigravity.
- Plugin4Shell defeats SHA pinning: agents check out pinned commits without verifying where the checkout landed.
- Zero-click via background auto-updates; branch names resembling hashes enable swaps on Bitbucket and self-hosted git servers.
- Claude Code fixed in 2.1.179 and Codex in 0.146.0; Copilot unpatched and Gemini CLI deprecated without a fix.
- AIR's SkillJacking research showed 925 hijacked skills reaching 134,000 agents, proving takeover at scale.
- An earlier AIR test plugin spread to more than 26,000 agents before being pulled.
- Organizations
- AIR
From the original article
3 min read at helpnetsecurity.com
Four major AI coding agents, Claude Code, Codex, GitHub Copilot and Gemini CLI, all share the same zero-click RCE vulnerability, one that could give an attacker the same reach into a company’s systems and data as the employee running the agent, according to AIR. “It is the first supply chain vulnerability of the AI agent ecosystem,” the researchers said.
By Sinisa Markovic · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.