Analysis
A zero-click remote-code-execution vulnerability nicknamed "Plugin4Shell" was found affecting four of the most widely used AI coding agents -- Claude Code, OpenAI's Codex, GitHub Copilot and Google's Gemini CLI -- according to The Information and Help Net Security. Claude Code, Codex and Copilot share one version of the bug tied to how git handles branch names during a plugin SHA-pinning check; Gemini CLI is exposed through a separate mechanism in how it fetches and verifies pinned commits.
Why 'Zero-Click' Is The Scary Part
The flaw requires no user action to trigger. Because the same git checkout process re-runs automatically on background auto-update -- the default behavior in both Claude Code and Codex -- when a plugin marketplace bumps its pinned commit SHA, the swap silently reaches every already-installed plugin without the user clicking anything, opening a link, or approving an update. That removes the one defense most security awareness training relies on: a suspicious user declining to click something unfamiliar. There's nothing to decline here.
“## Why 'Zero-Click' Is The Scary Part The flaw requires no user action to trigger.”
An Uneven Response Across Four Vendors
Anthropic patched Claude Code in version 2.1.179 and OpenAI patched Codex in version 0.146.0, both relatively quickly once the flaw was disclosed. Microsoft has not shipped a fix for GitHub Copilot, leaving its users exposed with no patch available as of this reporting. Google's response was different again: rather than patch Gemini CLI, the company deprecated the tool entirely -- which means every existing Gemini CLI installation remains vulnerable indefinitely, since there is no update path to a fixed version for a product the vendor has stopped supporting.
A Pattern, Not A One-Off
This is at least the second architecturally-related security issue to hit the same cluster of AI coding agents this year. An earlier "Comment and Control" vulnerability -- in which untrusted data from a GitHub issue or comment could flow into an agent holding production secrets and unrestricted tool access within the same runtime -- affected an overlapping set of tools. Two distinct vulnerability classes hitting the same competitive set of products within one year suggests the industry's approach to sandboxing plugin execution and separating untrusted external input from privileged agent runtimes has a structural gap that individual patches address one instance of at a time, without necessarily fixing the underlying pattern.
Whose Patch Cycle Are You Trusting?
For venture-backed companies building on top of any of these four coding agents -- and there are dozens of well-funded startups doing exactly that -- the practical question is which vendor's security response speed and transparency you're actually depending on. Anthropic and OpenAI's fast patches are the better outcome here, but Microsoft's silence on a Copilot fix and Google's decision to simply retire Gemini CLI rather than patch it are both, in different ways, worse than a slow patch: one leaves a known hole open with no timeline, the other leaves users with no fix at all. Startups with CI pipelines wired into any of these tools should confirm which version they're running against the disclosed patch numbers rather than assuming their agent auto-updated safely.