Air Security researchers disclose Plugin4Shell zero-click flaw in AI coding agents

September 18, 2026 at 06:37 PM1 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Air Security researchers disclosed a critical zero-click vulnerability named Plugin4Shell affecting major AI coding agents. The flaw allows attackers to replace benign plugins with malicious versions, enabling remote code execution. Anthropic and OpenAI have issued patches, while Microsoft's Copilot remains vulnerable.

Key Facts

Plugin4Shell is a zero-click vulnerability discovered by Air Security researchers.
The vulnerability affects AI coding agents including Anthropic's Claude Code, OpenAI's Codex, Google's Gemini CLI, and Microsoft's Copilot.
The attack bypasses SHA-pinning, allowing malicious plugin replacement and remote code execution during auto-updates.
Anthropic and OpenAI have issued patches, Google deprecated the affected Gemini CLI, and Microsoft's Copilot remains vulnerable.
GitHub stated its platform is not affected due to specific mitigation measures.

Vulnerability Discovery

Air Security researchers discovered the critical zero-click vulnerability named Plugin4Shell. The flaw impacts prominent AI coding agents and potentially exposes sensitive data and assets. The exploit targets trusted plugin marketplaces used by AI coding agents. Researchers described the attack as a first-of-its-kind AI supply-chain attack.

Affected Platforms and Responses

Anthropic's Claude Code, OpenAI's Codex, Google's Gemini CLI, and Microsoft's Copilot are affected. Anthropic and OpenAI have issued patches to address the vulnerability. Google has deprecated the affected Gemini CLI. Microsoft's Copilot remains vulnerable, while GitHub stated its platform is not affected due to specific mitigation measures.

Attack Mechanism and Risks

The exploit bypasses the SHA-pinning mechanism designed to prevent malicious code injection. Attackers can replace benign plugins with malicious versions, leading to zero-click remote code execution when agents auto-update. Researchers warn that the attack can be scaled through marketplace takeovers, compromising the integrity of AI development tools.