Never lose a customer to a missed message
An AI agent trained on your own business, replying in seconds, in any language, on every channel your customers already use.
Security researchers disclosed a flaw this week that lets an attacker hijack a popular AI coding assistant without the user clicking anything at all. The Plugin4Shell vulnerability disclosed by researchers at the security startup Air affects four of the most widely used AI coding agents: Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI.
The bug breaks SHA pinning, the mechanism developers rely on to lock an installed plugin to a specific, reviewed version of its code. A malicious plugin update can swap in attacker-controlled code that runs automatically, without requiring the user to approve or reinstall anything.
The short version: Plugin4Shell needs zero clicks to work. It breaks SHA-pinning protections. The flaw affects four major coding agents. Anthropic and OpenAI patched Claude Code and Codex. Google will not fix Gemini CLI. Microsoft had no fix at disclosure.
How the Plugin4Shell Vulnerability Works
AI coding agents commonly support plugins that extend their functionality, similar to browser extensions. Developers typically pin a plugin to a specific version using its SHA hash, expecting that hash to guarantee the code cannot silently change. Plugin4Shell defeats that guarantee, letting an update slip through even when the pinned hash appears to match.
Researchers describe it as a first-of-its-kind AI supply-chain attack. Because these plugins often inherit the same permissions as the developer running the agent, a successful exploit can reach local source code, cloud credentials, SSH keys, internal repositories, production systems and other secrets.
No phishing email is needed here. No fake login page either. The plugin update itself is the attack. That is what makes it dangerous. Most security training does not cover this scenario at all.
Who’s Patched, Who Isn’t
Anthropic fixed the issue in Claude Code version 2.1.179. OpenAI patched Codex in version 0.146.0. Google is deprecating Gemini CLI and will not release a fix, instead advising users to migrate to its replacement, Antigravity. Microsoft had not issued a fix for GitHub Copilot at the time of disclosure, though GitHub noted that its platform separately blocks SHA-like branch and tag names, which limits one avenue of the attack.
Why This Matters Beyond Individual Developers
AI coding agents are increasingly embedded in company workflows, often running with broad access to internal systems to be useful. A vulnerability that requires zero clicks to exploit removes the human judgment that normally catches a suspicious download or unfamiliar prompt. Security teams are treating this less as a single bug and more as a warning about how much trust has been extended to AI coding tools without commensurate scrutiny of their plugin ecosystems.
Researchers at Air called it a first-of-its-kind AI supply-chain attack because it targets the trust relationship between a developer and their tools rather than a specific application. That distinction matters: traditional supply-chain attacks compromise a package or library, while this one compromises the update mechanism developers assumed was locking their plugins in place.
Why the Plugin4Shell Vulnerability Disclosed This Week Caught Vendors Off Guard
Four unrelated companies, each with its own security review process, shipped agents carrying the same underlying flaw. That suggests the SHA-pinning assumption Plugin4Shell defeats was treated as settled, trusted infrastructure across the industry rather than something any individual vendor had reason to re-examine. Researchers say this kind of shared blind spot is common in fast-moving software categories, where competitors converge on similar architectural patterns without cross-checking each other’s security assumptions.
What Developers Should Do Now
Anyone running Claude Code or Codex should confirm they are on the patched versions immediately. Gemini CLI users should plan a migration to Antigravity rather than waiting for a fix that Google has said will not come. Copilot users should watch for an official Microsoft patch and, in the meantime, review which plugins their agents have installed and what permissions those plugins carry.
Security teams managing multiple developers should also audit which AI coding tools are in use across their organization, since shadow adoption of these agents outside official IT channels makes a coordinated patch rollout harder to enforce.
The numbers at a glance: Tools affected: four. Clicks required to exploit: zero. Claude Code fix: version 2.1.179. Codex fix: version 0.146.0. Gemini CLI fix: none planned. Copilot fix: pending as of disclosure.
Plugin4Shell: Common Questions
What is Plugin4Shell?
A zero-click vulnerability that lets a malicious plugin update run attacker-controlled code inside AI coding agents by defeating SHA-pinning protections.
Which tools are affected?
Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI.
Has it been fixed?
Claude Code and Codex are patched. Gemini CLI will not receive a fix and is being deprecated. Copilot had no fix issued as of disclosure.
Does exploiting it require any user action?
No. That is what makes it a zero-click vulnerability — no click, approval or reinstall is needed.
What data is at risk?
Local source code, cloud credentials, SSH keys, internal repositories, production systems and other secrets the plugin’s host process can access.
Elsewhere on Tamara News
- Cloudflare’s move against AI bots shows how much of the web is now shaped by automated agents.
- Enterprise software outages are becoming a recurring stress test for how companies depend on cloud platforms.
- This vulnerability adds to a year already marked by some of the biggest data breaches on record.
Sources
- The Register — AI Coding Agents’ 0-Click RCE Flaw Could Hand Attackers Keys to the Kingdom. theregister.com
- Help Net Security — Zero-Click RCE Vulnerability Hit Four Major AI Coding Agents, Two Remain Unpatched. helpnetsecurity.com
- Air Security — Plugin4Shell: Zero-Click RCE Vulnerability Found in Top 4 Coding Agents. air.security
Verification your users actually receive.
Send one-time passcodes over WhatsApp with a single API call. Replio can generate, hash and verify the code for you.
