Researchers have disclosed “Plugin4Shell”, a zero-click remote-code-execution vulnerability affecting major AI coding agents, including Claude Code, Codex, Gemini CLI and Microsoft Copilot. The flaw targets trusted plugin marketplaces and could let attackers run malicious code with access to any data or systems reachable by the coding agent, creating a significant software supply-chain risk.

The vulnerability bypasses safeguards intended to pin plugins to immutable commit hashes, allowing a repository’s content to be replaced while the pinned reference appears unchanged. Anthropic and OpenAI have issued fixes, while Google will not patch its deprecated Gemini CLI and Microsoft Copilot remains disputed as vulnerable; automatic plugin updates can make exploitation require no user action.