Claude Code, Codex, Copilot, and Gemini CLI contained a zero click remote code execution flaw that bypassed security verification for third party plugins. The vulnerability, named Plugin4Shell, allowed attackers to replace a pinned plugin commit with malicious code that executed with full developer permissions on a user's machine by breaking SHA pinning.

Claude Code and Codex released patches for the vulnerability, which requires an attacker to have control of the plugin repository to succeed. The flaw exposes security risks in the AI agent supply chain by allowing malicious code to be injected into tools after users have already downloaded the software.