Security researchers at AIR disclosed a vulnerability in mid-September 2026 that affected four of the most widely used AI coding agents at once: Anthropic's Claude Code, OpenAI's Codex, GitHub Copilot, and Google's Gemini CLI. Named Plugin4Shell, it is a zero-click remote code execution flaw, meaning attacker-controlled code could run on a developer's machine with no click, approval, or reinstall required. It is being described as the first supply-chain vulnerability of the AI agent ecosystem, and that framing is the key to understanding it. The flaw is not in any AI model. It is in the plumbing that decides which plugin code an agent trusts.
The mechanism is a small, precise failure, and it is more instructive than a dramatic one would be.
What SHA pinning is, and how it broke
Plugins extend a coding agent with extra capabilities, and they update over time. To keep updates safe, agents rely on SHA pinning: the marketplace records the exact commit hash of the reviewed code, so a plugin cannot silently change to something the developer never approved. In principle, once a plugin passes review, its pin locks it to that specific, inspected version.
Where the pin quietly stops protecting you
The pin still looks honored the whole way through. The failure is a missing verification step, not a broken cryptographic hash.
Zero-click means no reinstall, no approval prompt, and no user action. A routine plugin update is enough for the swap to take effect.
The flaw is that the agent checked out the pinned commit but never verified that the checkout actually resolved to it. An attacker who controls the plugin's repository, through a compromised or malicious maintainer account, can make the reference the agent follows resolve to different code while the pin still appears honored. The cryptographic hash is not broken. The verification step that would have caught the mismatch was simply missing. So a routine plugin update becomes a delivery mechanism, and nothing in the developer's normal workflow signals that anything changed.
Why the blast radius is large
The reason this matters more than a typical plugin bug is what a plugin can reach. These add-ons often run with the same permissions as the developer running the agent.
That inheritance is the whole problem. A compromised plugin can reach local source code, cloud credentials, SSH keys, internal repositories, production systems, and stored secrets, because the agent it rides in already has that access to do its job. An AI coding agent is, by design, a highly privileged process sitting in the middle of a developer's environment. Turning its extension system into an execution path hands an attacker that privilege directly, which is why researchers describe the potential impact as handing over the keys to the kingdom.
The hash was never broken. The agent just never checked that the code it ran was the code it pinned. Trust without verification is the entire vulnerability.
Metir analysis
One design, four vulnerabilities
The striking part is that the same weakness appeared across four independently built products. That is not a coincidence so much as a sign of convergent design: the AI coding agents that shipped in 2025 and 2026 borrowed similar plugin and pinning patterns, and they inherited the same missing verification step along with them. A shared architecture produced a shared flaw.
One flaw, four vendors, four responses
A shared design pattern produced a shared weakness. The remediation split by how each vendor still supports the tool.
A deprecated tool that will not be patched still runs on the machines of developers who have not migrated, which is why disclosure timing and migration guidance matter as much as the fix itself.
The response split along a predictable line, which was how each vendor still supports the tool. Anthropic patched Claude Code, and OpenAI patched Codex. Microsoft had not released a fix for GitHub Copilot at the time of disclosure. Google reportedly decided not to patch the Gemini CLI because it is deprecated, advising users to migrate to its successor instead. A deprecated tool that will not be fixed still runs on the machines of everyone who has not migrated, which is why the timing of disclosure and the clarity of migration guidance are part of the remediation, not a footnote to it.
Anthropic
OpenAI
Microsoft
GoogleWhat developers and teams should do
The immediate steps are concrete. Update to the patched versions where they exist: Claude Code 2.1.179 and Codex 0.146.0 at the time of writing. If you rely on a tool that is unpatched or deprecated, treat migration as security work with a deadline, not a someday task. Audit which plugins your agents run and who maintains them, because the attack rides through a maintainer you have already chosen to trust.
The deeper lesson is about privilege. The damage here scales with how much access the agent, and therefore its plugins, holds. Running coding agents with the narrowest permissions that still let them work, isolating credentials and production access from the environment where agents execute untrusted extensions, and keeping the freedom to move off a tool that stops being maintained are all ways to shrink the blast radius before the next flaw of this shape appears. Plugin4Shell will not be the last supply-chain issue in the AI agent stack, because the stack is new and the trust assumptions inside it are still being tested. Least privilege and the ability to switch tools are the defenses that hold regardless of which specific bug comes next.
Sources:
- AI coding agents' 0-click RCE flaw could hand attackers keys to the kingdom | The Register
- Zero-click RCE vulnerability hit four major AI coding agents, two remain unpatched | Help Net Security
- A zero-click RCE flaw in AI coding agents could have exposed enterprise systems | CSO Online
- Plugin4Shell: Zero-click RCE in the top four AI coding agents | AIR
Image credits
Code on computer monitor, by Markus Spiske via Unsplash, uploaded to Wikimedia Commons, released under CC0 1.0.