A zero-click RCE flaw in AI coding agents could have exposed enterprise systems

Summary

Researchers at AIR found a zero-click flaw they call Plugin4Shell in AI coding agents including Claude Code, Codex, Gemini CLI and GitHub Copilot. The agents pass a plugin's commit SHA to Git without verifying the checked-out commit, so an attacker controlling the plugin repository can serve malicious code under the trusted SHA or a FETCH_HEAD name, executing it without developer interaction.

Mitigation

Anthropic fixed the issue in Claude Code version 2.1.179 and OpenAI addressed it in Codex version 0.146.0. Google deprecated Gemini CLI and will not issue a fix, suggesting users move to Antigravity. GitHub has not released a fix for Copilot, though it restricted creating version or tag names that resemble commit SHAs.

Topics

• AI agents

Related items

• InfoWhat we know so far about the Microsoft outageSame vendor · BBC Technology
• InfoSilicon Valley claims to know the future. So why did it get the midterms so wrong?Same vendor · MIT Technology Review
• InfoOpenAI Unveils Daybreak Red Team, Defense Factory Security ToolsSame vendor · SecurityWeek
• InfoAn AI kill switch isn’t enough. Build a fallback planSame vendor · CSO Online
• InfoWhat happened overnight with the Microsoft global outage?Same vendor · BBC Technology