Researchers say a flaw in major AI coding agents can let a malicious plugin or skill run code on a user’s machine without any interaction. The issue, dubbed Plugin4Shell, is a SHA-pinning bypass in plugin marketplace handling that affects Anthropic Claude Code, OpenAI Codex, Google Gemini CLI, and Microsoft Copilot; Anthropic patched it in Claude Code 2.1.179 and OpenAI in Codex 0.146.0, while Google deprecated Gemini CLI without a fix and Microsoft Copilot was still unpatched at publication.
Why it matters: Anyone using these AI coding agents could be exposed if the agent can access sensitive files, cloud credentials, or source code, because the malicious plugin executes with the agent’s own privileges. Organizations using these tools should update patched products immediately, review allowed plugin sources, and restrict agent access to sensitive systems.
2026.09.17
100% relevant
This article establishes a distinct newly reported vulnerability event centered on the Plugin4Shell attack and vendor responses, rather than updating an already tracked specific flaw.
← Back to all stories