{"data":{"id":"e944c71c-5ed9-494a-9270-0d74a7fc1e0d","title":"A zero-click RCE flaw in AI coding agents could have exposed enterprise systems","summary":"Researchers at AIR found a zero-click flaw they call Plugin4Shell in AI coding agents including Claude Code, Codex, Gemini CLI and GitHub Copilot. The agents pass a plugin's commit SHA to Git without verifying the checked-out commit, so an attacker controlling the plugin repository can serve malicious code under the trusted SHA or a FETCH_HEAD name, executing it without developer interaction.","solution":"Anthropic fixed the issue in Claude Code version 2.1.179 and OpenAI addressed it in Codex version 0.146.0. Google deprecated Gemini CLI and will not issue a fix, suggesting users move to Antigravity. GitHub has not released a fix for Copilot, though it restricted creating version or tag names that resemble commit SHAs.","labels":["security","industry"],"sourceUrl":"https://www.csoonline.com/article/4223909/a-zero-click-rce-flaw-in-ai-coding-agents-could-have-exposed-enterprise-systems-2.html","publishedAt":"2026-09-18T15:42:30.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["supply_chain"],"issueType":"news","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["OpenAI","Anthropic","Google","Microsoft"],"affectedVendorsRaw":["Codex","Claude Code","Gemini CLI","GitHub Copilot"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-09-18T15:42:30.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"plugin","llmSpecific":true,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":["AML.T0010"]}}