Plugin4Shell: Zero-Click Flaw Hits Multiple AI Coding Agents
September 21, 2026 · Security Four AI coding agents share a zero-click plugin vulnerability tracked in briefings as Plugin4Shell. Two of the affected products were…
Security
Zero-Click Flaw Hit Plugins in Claude Code, Codex, Copilot, and Gemini CLI
Researchers at AIR disclosed Plugin4Shell on September 18: a zero-click remote-code-execution pattern that let attackers swap malicious plugin code past SHA-pinning checks in Claude Code,…