Your Coding Agent Installs Software. Did You Notice?

Security researchers at AIR disclosed a flaw on September 17 that sits inside all four of the coding agents small teams actually use: Claude Code, Codex, GitHub Copilot and Gemini CLI. They call it Plugin4Shell. It lets an attacker run code on your machine with the same reach you have.

Their own framing is the part worth sitting with. "It is the first supply chain vulnerability of the AI agent ecosystem," the researchers said.

Most founders read a headline like that and skip it. Security is somebody else's job, and there is a demo on Thursday. But this one is different in a way that matters for a four person company, because the people it hits are the ones who did everything correctly. You picked a plugin from a marketplace you trust. It passed review. It was pinned to a reviewed version. That is the whole security model, and the whole security model is what broke.

SHA pinning locks an installed plugin to one exact reviewed version of its code. The promise is simple: once it passes review, it cannot change without you knowing.

AIR found that all four agents check out the pinned commit and then never verify the checkout actually landed there. So an attacker who controls the plugin's repository can make that checkout resolve to different code while the pin still looks honored. Claude Code, Codex and Copilot share one version of the bypass, tied to how git handles branch names. Gemini CLI gets there through a separate mechanism. Same outcome.

There is a wrinkle that decides who is exposed. The trick only works where a branch can be named like a commit hash. GitHub rejects a 40 character hex branch name outright. Bitbucket allows it. So does any self hosted git server. If your plugins come from repos on GitHub, this particular path is closed to you. If they do not, it is open.

The zero-click part is the background auto-update. That same checkout re-runs when the marketplace bumps a pinned version, and background updating is the default in Claude Code and Codex. Nobody clicks anything. Nobody approves anything. The swap reaches plugins you installed months ago.

Two shapes, and neither requires a movie villain.

In the first, somebody publishes a plugin that does exactly what it says. It is useful. It passes review, people install it, it sits there behaving for weeks. Then the author flips it. AIR has already shown this works: a plugin they built spread to more than 26,000 agents before it was pulled.

In the second, the attacker does not write anything. They take over the repository behind a plugin somebody else wrote and everyone already trusts, then push malicious code to every install. AIR documented this separately in research they call SkillJacking, where they found 925 skills already in active use that had been hijacked from their original maintainers, reaching roughly 134,000 agents.

Put those together and the picture is uncomfortable. Takeovers happen at scale. Pinning was the thing that was supposed to contain them. Pinning is what Plugin4Shell defeats.

AIR found this in May 2026 and told every vendor in June. Four companies got the same report, with working proof-of-concept exploits, at roughly the same time. What they did next is the useful data.

Anthropic patched Claude Code in version 2.1.179. OpenAI patched Codex in version 0.146.0. Microsoft, told about the identical flaw in Copilot, has not shipped a fix. Google took a third path and deprecated Gemini CLI rather than patching it, which means existing installs stay exposed with no end date, and the advice to those users is to migrate to a newer agent called Antigravity that was built without the plugin pinning system this attack targets.

Read that as a procurement signal, because it is one. You are not choosing between four products that are the same except for the model behind them. You are choosing between four organizations with visibly different answers to "we found something in your tool." Two fixed it. One did not. One walked away from the product. Three months, same information.

The check runs inside the agent, not at the marketplace, which is why no marketplace can protect you on its own. Updating is the only complete fix, and only where a fix exists.

You can do this today, and it is mostly not technical.

Write down every agent anyone on the team runs. Not the approved list. The real one. Ask in Slack. People install these on personal laptops and use them on company code.

Check versions against the patched ones. Claude Code needs 2.1.179 or later. Codex needs 0.146.0 or later. Copilot has nothing to update to. Gemini CLI has nothing coming.

List the plugins each agent has installed, including the ones somebody added during a late night debugging session in April and forgot. For each, note who maintains it and where the repository lives. GitHub or somewhere else matters here.

Turn off background auto-update where you can, at least until you have the list. Convenience is what turned an install-time bug into a zero-click one.

Decide what these agents can reach. An agent running with your credentials on your laptop can touch whatever you can touch: production keys in your shell environment, the internal repo, the cloud console you left authenticated. Most small teams have never drawn this boundary because there was never a reason to.

Ninety minutes. Maybe less if you are three people.

Early stage companies adopt developer tools the way people adopt apps, which is to say instantly and without a record. Somebody finds something useful, installs it, tells the group chat. That worked when the tool was a linter.

It works less well when the tool runs code on your behalf, updates itself in the background, and pulls in third party extensions from a marketplace. That is not a text editor. That is a piece of your production supply chain, and you have no list of what is in it.

The fix is boring and takes an hour a quarter. Keep a written record of every tool that can execute code or reach your data, who owns it internally, what it connects to, and what happened the last time its vendor had a security problem. A spreadsheet is fine. Notion is fine. A planning workspace like Foundra works too if you already keep your operating decisions there and want this next to the rest of them. The tool matters far less than the fact that the list exists and somebody looks at it.

Then add one line to how you evaluate anything new: what did this vendor do the last time researchers found something? You now have four public answers to that question.

That is a real option and it is worth pricing out rather than pretending everyone will run the audit.

Doing nothing means accepting that an attacker who compromises one plugin author reaches your laptop with your access. For most seed stage companies that is customer data, a production database, source code and whatever is in the shell environment. The blast radius is not "our dev environment." It is the company.

It also means you find out during due diligence. Acquirers and enterprise customers have started asking what agents your team runs and what those agents can touch. Answering "we would have to check" in a security questionnaire is a slower answer than it looks, because the next question is how you make decisions generally.

If the audit truly cannot happen this week, do the two minute version: update Claude Code and Codex, and turn off background plugin updates everywhere else. That closes most of it while you find the time.

Pinning was the promise, and pinning is what broke. The victims here are people who followed the security model as designed.

Background auto-update is what made it zero-click. Turning it off is the fastest single thing you can do.

Two of four vendors patched. Claude Code 2.1.179 and Codex 0.146.0 are fixed. Copilot has no fix. Gemini CLI was deprecated instead.

Your exposure depends partly on where your plugin repos live. GitHub blocks the branch naming trick. Bitbucket and self hosted servers do not.

The inventory is the deliverable, not the fix. You cannot patch a list of tools you have never written down.

Is my company affected if we only use Claude Code?

If you are on version 2.1.179 or later, that specific flaw is patched. Check your version first, because background updates do not always land when you assume they did.

We have no plugins installed. Are we fine?

For this bug, yes. The attack needs an installed plugin to hijack. That also makes "no plugins" a defensible default for a small team that does not need them.

Why is Copilot still unpatched?

Microsoft received the same disclosure in June 2026 and has not shipped a fix as of September 18. AIR's position is that the check has to happen inside the agent, so there is no workaround a marketplace or a user can apply on their own.

Should we drop Gemini CLI?

Google deprecated it rather than patching, so existing installs stay exposed indefinitely. Google's own guidance is to move to Antigravity. That is a reasonable reason to move.

How often should a five person startup redo this inventory?

Once a quarter, or any time you add a tool that can execute code or hold a credential. Twenty minutes on a Friday is enough once the first list exists.

Does this mean AI coding agents are too risky to use?

No. It means they are infrastructure, not apps, and should be treated the way you treat anything else with production access: known, versioned, scoped, and owned by somebody.

1. Zero-click RCE vulnerability hit four major AI coding agents, two remain unpatched (Help Net Security, Sept 18 2026)
2. Plugin4Shell: Zero-Click RCE in the four most popular coding agents (AIR)
3. Plugin4Shell Zero-Click RCE Hits Claude Code, Codex, Copilot and Gemini CLI (GBHackers)
4. A zero-click RCE flaw in AI coding agents could have exposed enterprise systems (InfoWorld)
5. Plugin4Shell Zero-Click RCE Hits Claude Code, Codex, Copilot and Gemini CLI (Cyber Security News)