AI Coding Agent Flaw Exposes Four Tools To Dangerous

Security researchers say an AI coding agent flaw, Plugin4Shell, exposes four widely used coding tools to zero-click remote code execution. It bypasses SHA pinning by swapping a trusted plugin dependency for malicious code without a victim clicking anything.

Key Takeaways

Plugin4Shell exposes four widely used AI coding tools to zero-click remote code execution by bypassing SHA pinning
Claude Code and Codex have shipped patches, while GitHub Copilot and Gemini CLI remain exposed
The flaw swaps a trusted plugin dependency for malicious code without requiring a victim to click anything
OpenAI patched two unrelated Codex sandbox escapes this month that allowed unapproved code to run outside containment

AI Coding Agent Flaw Hits Plugin Chains

The vulnerability was disclosed within the past hour by researchers tracking the exploit. related reporting is available here. Anthropic‘s Claude Code and OpenAI‘s Codex have shipped patches, while Microsoft‘s GitHub Copilot and Google‘s Gemini CLI remain exposed, according to the disclosure circulating among security researchers this hour.

SHA pinning locks a software dependency to a specific cryptographic fingerprint rather than trusting whatever version a package name resolves to.

It is meant to stop a compromised or swapped package from silently running on a user’s machine, but Plugin4Shell allows an attacker to inject code into an agent’s plugin chain without a hash mismatch alarm.

Four unrelated vendors sharing the same AI coding agent flaw points to the pinning mechanism itself as the weak point, not any single company’s implementation. These agents write, execute and modify code with far less human oversight than traditional developer tools, so a single injected dependency can spread into every repository the agent touches before anyone notices.

For independent builders running these tools in CI pipelines, the exposure matters because coding agents moved from novelty to daily infrastructure faster than the security review cycles that normally vet enterprise software.

The disclosure does not change the practical divide: patched Claude Code and Codex are available, while Copilot and Gemini CLI users face an unpatched window.

OpenAI separately disclosed and patched two unrelated Codex sandbox escapes this month, incidents that let unapproved code run outside its intended containment. That distinct flaw, unrelated to the SHA pinning bypass, shows the same pattern of agents executing code with too little containment around them.

Whether GitHub and Google ship fixes before attackers weaponize the Plugin4Shell bypass at scale is the open question security teams are watching this week.

Enterprise security teams that embedded these agents into CI pipelines now face an unpatched exposure window on two of the four affected tools.