Critical Zero-Click RCE Flaw Found in Major AI Coding Agents Researchers at AIR (AI Incident Response) have uncovered a severe zero-click remote code execution (RCE) vulnerability, dubbed Plugin4Shell, affecting four leading AI coding agents: Claude Code, Codex, GitHub Copilot, and Gemini CLI. The flaw allows attackers to bypass SHA pinning a security mechanism designed to lock plugins to verified versions granting them the same access to systems and data as the user running the agent. ### How the Vulnerability Works The bug exploits weaknesses in how these agents verify pinned plugin commits. Normally, SHA pinning ensures that once a plugin passes review, its code cannot be altered without detection. However, AIR found that all four agents fail to confirm whether the checked-out code matches the pinned commit, enabling attackers to swap in malicious code while the pin appears intact. - Claude Code, Codex, and GitHub Copilot share a flaw tied to Git’s handling of branch names, where a branch can be named like a hash. - Gemini CLI has a separate issue in its commit-fetching process, leading to the same outcome. The attack is particularly dangerous because it is zero-click exploitable even on auto-updating plugins without user interaction. Since the vulnerability persists in background updates, already-installed plugins remain at risk. ### Attack Vectors AIR demonstrated two primary methods for exploitation: 1. Malicious Plugin Takeover – An attacker publishes a legitimate plugin, passes review, and later replaces it with malicious code. 2. Repository Hijacking – An attacker compromises a trusted plugin’s repository (as seen in AIR’s SkillJacking research, where 925 hijacked plugins reached 134,000 agents). ### Vendor Responses AIR disclosed the flaw to vendors in June 2026 after discovering it in May 2026: - Anthropic patched Claude Code (v2.1.179). - OpenAI fixed Codex (v0.146.0). - Microsoft has not released a patch for GitHub Copilot, leaving users exposed. - Google deprecated Gemini CLI entirely, advising users to migrate to Antigravity, a newer agent without the vulnerable plugin system. Since the issue lies within the agents themselves, marketplace protections alone are insufficient. The only complete fix requires vendor updates, leaving some users indefinitely vulnerable.