Zero-click RCE vulnerability hit four major AI coding agents, two remain unpatched
Researchers disclosed Plugin4Shell, a zero-click RCE SHA-pinning bypass in Claude Code, Codex, GitHub Copilot, and Gemini CLI; two remain unpatched.
7
Stories per day · 30 days
2 RSS
2 stories, newest first · one card per story
Stories tagged #sha-pinning
AI coding agents' 0-click RCE flaw could hand attackers keys to the kingdom
Researchers disclosed Plugin4Shell, a zero-click RCE in major AI coding agents' plugin SHA-pinning; Anthropic and OpenAI patched, Microsoft and Google did not.
6