Zero-click flaw in top AI coding agents enables remote code execution

A zero-click remote code execution vulnerability affecting every major AI coding agent was disclosed Thursday by researchers at Air, a security startup focused on protecting enterprise AI systems. The flaw, dubbed "Plugin4Shell," bypasses the SHA-pinning mechanism that agents use to lock plugins to verified code, potentially giving attackers full access to developer machines and every asset reachable by the compromised agent.theregister+1

How the Attack Works

The vulnerability targets trusted marketplaces that host plugins for Anthropic's Claude Code, OpenAI's Codex, Google's Alphabet Inc. ↗ 0.78% Gemini CLI, and Microsoft's ↘ 0.99% Copilot. Rather than attacking the AI model directly, Plugin4Shell exploits a gap in how agents verify plugin integrity. The agent checks out the exact commit a marketplace has pinned but never confirms it actually landed on the correct code, allowing an attacker who controls the plugin's repository to swap in malicious code while the pin appears intact.air+1

Because agents auto-update installed plugins by default, the attack requires no user interaction. "The result is zero-click remote code execution," Air researchers Or Nevo, Dor Granat, and Niv Hoffman wrote in their report. The researchers described two attack paths: submitting a benign plugin that passes marketplace review before replacing it with malicious code, or hijacking a legitimate author's repository to push a malicious version to every agent that has the plugin installed.theregister+1

Patching Remains Incomplete

Air reported the vulnerability to all four vendors in June. Anthropic and OpenAI patched it in Claude Code 2.1.179 and Codex 0.146.0, respectively. Google, having deprecated Gemini CLI, told Air it will not issue a fix, instead directing users to its newer Antigravity agentic development environment.theregister

Microsoft has not patched Copilot. A GitHub spokesperson told The Register that GitHub's existing controls — blocking users from creating branch or tag names resembling commit SHAs — prevent exploitation on its platform. Air's researchers disagreed, noting that marketplaces can also be hosted on platforms like Bitbucket Atlassian Corporation ↘ 16.15%, where no such mitigation exists, leaving Copilot exposed.theregister

A Growing Attack Surface

The disclosure adds to a mounting series of security concerns around AI coding tools. Nearly 90 percent of Fortune 500 companies use Copilot, according to Microsoft. Earlier research presented at Black Hat 2026 in August separately demonstrated that AI coding agents from Anthropic, Google, and OpenAI were vulnerable to prompt injection attacks enabling credential theft and supply chain compromise.esecurityplanet+1

"The fix has to ship in the agent, and updating is the only complete mitigation where one exists," the Air researchers wrote.theregister