Researchers disclosed a zero-click remote code execution vulnerability called Plugin4Shell that affected Claude Code, Codex, GitHub Copilot, and Gemini CLI. The flaw allowed attackers with control of a plugin repository to inject malicious code by bypassing SHA pinning, a security measure intended to lock plugins to specific git commits. Claude Code and Codex issued patches for the vulnerability, while Google deprecated the Gemini CLI instead of fixing it and GitHub Copilot remains unpatched.

The vulnerability enables malicious auto-updates to run with a developer's full system permissions, turning AI agent plugin systems into a vector for software supply chain attacks. These security risks persist as professional workflows rely more heavily on AI assistants and third-party skills that agents failed to verify upon installation on the local disk.