A security firm just found a hole big enough to drive a truck through, and it's sitting inside the four most popular AI coding tools on the planet. Claude Code, from Anthropic. Codex, from OpenAI. GitHub Copilot, from Microsoft. Gemini CLI, from Google. If you don't write code yourself, stick with me, because a lot of solo founders, small business owners, and side hustlers now use one of these to build a website or an app without hiring a developer. Researchers at a cybersecurity startup called AIR disclosed a vulnerability they named Plugin4Shell, and it is a high severity, zero click remote code execution bug affecting all four agents. The flaw allows a malicious plugin update to execute attacker controlled code without requiring a user to click, approve, or reinstall anything.

Here's how it works, in plain terms. These coding agents let you install plugins, kind of like apps for your phone, that add extra features, and developers use something called SHA pinning to keep them safe. Pinning locks an installed plugin to one specific, reviewed version of its code so it cannot change without the developer's knowledge. Plugin4Shell breaks that lock: it is a plugin SHA pinning bypass where the agent checks out the exact commit the marketplace pinned but never verifies it actually landed there, so an attacker who controls the plugin's repo can make the checkout resolve to malicious code while the pin still looks honored. AIR was blunt about who is exposed: anyone running a major coding agent that installs plugins from a marketplace is at risk, and the victim only has to have a plugin installed, from a marketplace they trust, that was reviewed and pinned exactly as the security model intends.

And the exposure is not small. Plugins and extensions often inherit the same permissions as the developer running the agent, including access to local source code, cloud credentials, SSH keys, internal repositories, production systems, and secrets. AIR calls this the first supply chain vulnerability of the AI agent ecosystem, noting that previous agent security research targeted the model or the agent itself, while Plugin4Shell attacks the distribution layer underneath them, the marketplaces through which add-ons reach millions of machines. The bug was found in May 2026, with working proof of concept exploits against all four agents, and disclosed to each vendor the following month. In related research the same team found 925 skills already in active use had been hijacked from their original maintainers, reaching 134,000 agents, meaning this kind of takeover already happens at scale.

So where do things stand right now? Anthropic has patched Claude Code in version 2.1.179, and OpenAI has addressed the vulnerability in Codex 0.146.0. Microsoft had not yet released a fix for GitHub Copilot at the time of disclosure. A GitHub representative told The Register that the company already applies restrictions on creating version or tag names that resemble commit SHAs, which it says prevents the vulnerability from being exploited on GitHub itself, but researchers countered that this does not cover plugin marketplaces hosted elsewhere, such as Bitbucket. Google made the boldest call of all: it will not patch the deprecated Gemini CLI, and is instead advising users to migrate away from it entirely.

If you or anyone on your team relies on one of these four tools, don't wait for a headline to remind you. Update Claude Code and Codex right now if that's what you're running. If you're still on Gemini CLI, treat it as permanently exposed and migrate away. If your team is on GitHub Copilot, there's no patch yet, so this is the week to open your plugin list, check where each one is hosted, and remove anything you can't account for. Enterprises can also reduce exposure by restricting plugin sources and monitoring repository changes, though researchers are clear that the underlying flaw itself has to be fixed by the vendor. AIR Security published the full technical writeup themselves, with mitigation guidance, and it's worth a look even if you're not the one doing the patching. Someone in your business should be.

My Take This is the fourth security story I've covered in a matter of weeks that traces back to the exact same problem: AI companies keep asking us to trust a system, and the system keeps failing quietly, without anyone doing anything wrong. First it was a Chrome flaw that every AI browser copilot inherited. Then a Copilot bug that leaked Gmail, Drive, and calendar data with one click, a bug Microsoft sat on for nearly eight months. Then two separate confessions, from OpenAI and Anthropic, that their own models had broken into a real company's servers just to win a benchmark. Now it's the marketplaces feeding plugins into the agents themselves. Different companies, different flaws, same pattern: ship first, patch later, and hope the gap doesn't get exploited before someone notices.