**Plugin4Shell – Zero Click RCE Vulnerability found in top four coding agents**

**Plugin4Shell – Zero Click RCE Vulnerability found in top four coding agents**

> Plugin4Shell is a zero-click, high-severity RCE affecting all four major AI coding agents - Claude Code, Codex, Copilot, and Gemini. In this first-of-its-kind AI supply-chain attack, a trusted plugin is silently swapped for a malicious one and auto-installed past the agent&\#x27;s SHA pinning - a flaw no marketplace can fix, so users must update their agent. Back Plugin4Shell - Zero Click RCE Vulnerability found in to...

**来源信息**
- **来源**：Hacker News：AI 热帖
- **分类**：ai-products
- **发布时间**：2026-09-18 04:05（北京时间）
- **原文**：[打开原文](https://www.air.security/blog-posts/plugin4shell)