A zero-click remote code execution vulnerability dubbed "Plugin4Shell" affects all major AI coding agents—Anthropic's Claude Code, OpenAI's Codex, Google's Gemini CLI, Microsoft's Copilot, and Microsoft-owned GitHub Copilot—according to researchers at security startup Air. Described as a "first-of-its-kind AI supply-chain attack," it targets trusted marketplaces hosting plugins rather than the models or agents themselves, potentially reaching millions of users and machines and giving attackers full access to every asset and piece of data an agent can reach. Air reported the issue to all four vendors in June; Anthropic and OpenAI patched it in Claude Code 2.1.179 and Codex 0.146.0, respectively. Google deprecated Gemini CLI and said it will not patch, suggesting users migrate to its newer Antigravity environment. Microsoft did not fix Copilot, though a GitHub spokesperson said the attacks do not affect GitHub due to restrictions on branch or tag names resembling commit SHAs. Air said that mitigation is insufficient because marketplaces can be hosted on other platforms such as Bitbucket, leaving Microsoft Copilot vulnerable. The flaw sits in how agents enforce marketplaces' SHA-pinning mechanism, which locks plugins and skills to a specific, immutable commit hash.