Zero-Click Flaw Hit Plugins in Claude Code, Codex, Copilot, and Gemini CLI
Researchers at AIR disclosed Plugin4Shell on September 18: a zero-click remote-code-execution pattern that let attackers swap malicious plugin code past SHA-pinning checks in Claude Code,…