Plugin4Shell: Zero-Click RCE Flaw Discovered in Four Leading AI Coding Agents

Security researchers have disclosed Plugin4Shell, a zero-click remote code execution vulnerability affecting four major AI coding agents—Claude Code, Codex, GitHub Copilot, and Gemini CLI—that could allow attackers to inject malicious code into plugins after users have downloaded them. The flaw, discovered by AIR Security researchers and publicly revealed on September 17, 2026, exploits a fundamental weakness in how these platforms verify plugin integrity through SHA pinning, a cryptographic mechanism designed to lock plugins to reviewed versions.