A zero-click remote code execution flaw affecting widely used AI coding assistants has been publicly disclosed by security researchers at Air, a firm specializing in enterprise AI protection.

The vulnerability, named Plugin4Shell, targets the plugin update mechanisms of several prominent AI agents designed to write and modify code. Researchers identified the issue as a supply chain weakness in how these systems verify plugin integrity through SHA-pinning, a method intended to lock plugins to specific, immutable code revisions.

According to the Air team, the flaw allows attackers to bypass verification checks by replacing legitimate plugin content with malicious code while maintaining the appearance of a valid cryptographic pin. This enables execution of arbitrary code on systems where the affected agents are installed, potentially granting attackers access to sensitive data and internal networks.

The researchers demonstrated two attack vectors: submitting a seemingly benign plugin that is later altered to include malicious payloads, and hijacking a trusted repository to distribute compromised versions to all agents that reference it. These techniques build upon prior concepts such as SkillJacking and RepoJacking, which explored similar supply chain risks.

Mitigation strategies vary by vendor. Anthropic and OpenAI released patches in updated versions of Claude Code (2.1.179) and Codex (0.146.0), respectively. Google deprecated its Gemini CLI environment, which remains unpatched but is being phased out in favor of Antigravity, a newer development platform that does not share the same vulnerability. Microsoft addressed the issue in GitHub’s ecosystem but did not apply a fix to Copilot, citing architectural differences in how GitHub handles repository references. Researchers argue this partial mitigation is insufficient, as alternative code hosting platforms like Bitbucket could still be exploited.

The disclosure timeline indicates that the vulnerability was reported to all involved vendors in June, but responses were inconsistent. While some companies implemented fixes promptly, others did not provide public updates at the time of reporting. The researchers emphasized that updating the underlying agent software is currently the only complete remediation available where patches exist.

The incident underscores growing concerns about the security of AI agent ecosystems, particularly as these tools gain broader adoption across enterprises and development workflows. With major technology firms integrating AI assistants into critical operations, the incident highlights the need for rigorous supply chain validation and proactive vulnerability management in rapidly evolving AI infrastructures.