A remote code execution vulnerability allows attackers to target developer machines via compromised plugin updates for a group of leading AI coding assistants. This zero-click flaw, dubbed Plugin4Shell, impacts Gemini CLI, Claude Code, Codex, and Copilot by allowing unverified auto-updates to run with full system permissions.

The exploit requires the actor to maintain control of the plugin repository to insert malicious code into skills already installed by the user. By breaking SHA-pinning, the hole ensures locked plugin commits are never verified, which threatens security as workers rely more heavily on AI coding agents and third-party tools.