Security researchers at Air disclosed Plugin4Shell on September 18: a zero-click remote code execution vulnerability in the plugin-update mechanism shared by Claude Code, OpenAI Codex, GitHub Copilot, and Google Gemini CLI. The mechanism is almost elegant in how mundane it is -- these agents pin a plugin update to a specific 40-character commit SHA and verify against it before installing, which sounds safe. The break: an attacker creates a git branch whose name matches that 40-character hash. Git can prioritize a matching reference name over the actual commit object during checkout, so the agent checks out the attacker's branch, verifies a hash that matches by construction, and reports a clean, verified install while running the attacker's code.
"Zero-click" here isn't marketing language -- it's the literal mechanism. Claude Code and Codex update installed plugins automatically in the background by default, so no user has to click install, approve a prompt, or even be at the keyboard when the malicious update lands. Air is calling it a first-of-its-kind AI supply-chain attack for exactly that reason: the entry point isn't a phishing link or a malicious download the user chose to run, it's the agent's own routine self-update behavior.
The blast radius is the part worth sitting with: these plugins typically inherit the full permission set of whatever's running the agent -- local source code, cloud credentials, SSH keys, internal repos, and in a lot of real developer setups, production systems and live secrets. A zero-click RCE with that scope on a tool millions of developers now run daily is close to a worst-case supply-chain scenario for this specific category of software.
Patch status is split, and that split matters for anyone still on an affected client: Anthropic patched it in Claude Code 2.1.179, OpenAI in Codex 0.146.0. Google has deprecated Gemini CLI outright rather than patch it, and Microsoft has not fixed it in Copilot as of this writing. If you or your team runs Gemini CLI or Copilot with plugin auto-update on, this isn't a "wait for the next release" situation -- it's disable auto-update or stop using the plugin surface now, because the vendor isn't going to close it for you.
If you run Gemini CLI or GitHub Copilot with plugin auto-update enabled, that's an active, unpatched, zero-click RCE surface today, not a theoretical risk -- disable plugin auto-update on those two specifically, and confirm Claude Code is on 2.1.179+ and Codex on 0.146.0+ before assuming you're covered.