Researchers at the security startup Air have described a zero-click remote code execution flaw they call Plugin4Shell, and it reaches four of the most widely deployed AI coding agents.
The bug breaks SHA pinning, the control developers rely on to freeze a plugin to a specific reviewed version. Each affected agent checks out the pinned commit without confirming the checkout actually landed there, so an attacker can substitute malicious code while the pin still appears intact.
That is what makes the exposure unusual. The victim does not have to install anything careless. A plugin already present, pulled from a marketplace they trust, reviewed and pinned exactly as the security model intends, is enough. Once running, the injected code inherits everything the agent can reach – repositories, credentials, cloud sessions and the data sitting alongside them.
Air reported the issue to all four vendors in June. Anthropic shipped a fix in Claude Code 2.1.179 and OpenAI patched Codex 0.146.0. Google has deprecated Gemini CLI and told the researchers it will not patch, directing users toward its newer Antigravity toolkit, so every existing install stays exposed. Microsoft’s Copilot side remained unpatched.
Scale is the problem. Microsoft says almost 90 percent of Fortune 500 companies use Copilot, and the researchers describe the finding as the first supply chain vulnerability of the AI agent ecosystem.
The only complete mitigation where a fix exists is updating the agent itself. Teams running pinned plugins should inventory which agents are in use, confirm versions, and treat an unpatched coding agent as a live path into the source and secrets it can read.
