AI coding agents' 0-click RCE flaw could hand attackers keys to the kingdom
Plugin4Shell attack affects all the major coding agents, researchers say
A previously unknown vulnerability dubbed "Plugin4Shell" has been discovered in major AI coding agents such as Anthropic’s Claude Code, OpenAI’s Codex, Google’s Gemini CLI, Microsoft’s Copilot, and Microsoft-owned GitHub Copilot. This zero-click flaw enables remote code execution, potentially granting attackers full access to all assets and data within the agent's reach.
The exploitation method, called a “first-of-its-kind AI supply-chain attack,” targets trusted marketplaces that host plugins for these coding agents, affecting an estimated 90 percent of Fortune 500 companies using Copilot. Despite researchers reporting the issue to all four vendors in June, Microsoft and Google - the latter of which has deprecated the Gemini CLI - have not yet released patches.
Microsoft, meanwhile, does not acknowledge the vulnerability as affecting GitHub. The security issue stems from how AI agents enforce marketplaces' SHA-pinning mechanism, which locks plugins to a specific code hash instead of allowing updates. When an attacker takes control of a compromised repository, they can swap the benign plugin with malicious code, and the agent will install and execute the malicious version without user interaction.
Written by urgent.news from The Register Science's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
