Security researchers at Air Security disclosed a vulnerability dubbed Plugin4Shell affecting four AI coding agents: Anthropic's Claude Code, OpenAI's Codex, GitHub Copilot, and Google's Gemini CLI. According to a report by Air researchers Or Nevo, Dor Granat, and Niv Hoffman, the flaw is a "plugin SHA-pinning bypass" enabling zero-click remote code execution, allowing anyone controlling a plugin's code repository to swap the installed plugin for a malicious version even when locked to a specific reviewed commit. Because plugins run with the user's privileges, swapped code can access files, saved credentials, and accessible systems. Anthropic patched Claude Code 2.1.179 and OpenAI fixed Codex 0.146.0; GitHub Copilot has no fix, and Google will not patch Gemini CLI because it is retiring the product. The flaw stems from agents fetching a pinned commit snapshot without verifying the code matches the hash. On hosts allowing branch names resembling commit hashes, such as Bitbucket or internal git servers, a repository owner can point that name at different code, which the agent installs while reporting the locked version. Air built a working test attack in May and notified vendors in June. GitHub does not allow such branch or tag names, so plugins from GitHub repositories are not exposed to this vector.