A zero-click RCE flaw in AI coding agents could have exposed enterprise systems

Popular AI coding agents like Claude Code, Codex, GitHub Copilot, and Gemini CLI were vulnerable to Plugin4Shell, a zero-click RCE (remote code execution, where attackers can run malicious code on a system without user interaction) attack that let attackers swap legitimate plugins with malicious ones. The flaw exploited a verification gap: these agents checked out plugin code using a SHA (secure hash algorithm, a unique cryptographic identifier), but didn't verify that the correct version was actually retrieved, allowing attackers who controlled a plugin's repository to inject malicious code. Most vendors have now released patches for this vulnerability.