Researchers at AIR disclosed Plugin4Shell, a zero-click remote code execution vulnerability shared by four major AI coding agents — Claude Code, OpenAI's Codex, GitHub Copilot and Google's Gemini CLI. All four pin plugins to a reviewed commit hash but check out the pinned commit without verifying the checkout landed there, letting an attacker swap in malicious code while the pin still looks intact. AIR calls it the first supply chain vulnerability of the AI agent ecosystem.

The flaw is zero-click because the same git checkout re-runs on background auto-update: when a marketplace bumps the pinned SHA, the swap reaches already-installed plugins with no user action. AIR says it previously demonstrated plugins spreading to more than 26,000 agents and found 925 hijacked skills in active use reaching 134,000 agents, proving the takeover chain end to end.

Vendor response was uneven. Anthropic patched Claude Code in version 2.1.179 and OpenAI patched Codex in 0.146.0. Microsoft has not shipped a fix for Copilot, leaving its users with no patch. Google deprecated Gemini CLI entirely rather than patching it, meaning existing installs stay exposed indefinitely; its advice is to move to its newer agent, Antigravity.