AI coding agents' 0-click RCE flaw could hand attackers keys to the kingdom

Researchers disclosed Plugin4Shell, a zero-click RCE in major AI coding agents' plugin SHA-pinning; Anthropic and OpenAI patched, Microsoft and Google did not.

Air researchers disclosed Plugin4Shell, a plugin SHA-pinning bypass enabling zero-click remote code execution in major AI coding agents including Claude Code, OpenAI Codex, Gemini CLI, Microsoft Copilot, and GitHub Copilot. The agent checks out the commit a marketplace pinned but never verifies it, letting an attacker who controls the plugin repo make the checkout resolve to malicious code, and plugin auto-updates make the attack zero-click. Anthropic patched in Claude Code 2.1.179 and OpenAI in Codex 0.146.0 after June reports; Google deprecated Gemini CLI without a fix, and Microsoft has not patched Copilot, while Air disputes GitHub's SHA-naming mitigation as insufficient since Bitbucket-hosted marketplaces remain exposed.