A Zero-Click Bug Just Hit Four AI Coding Tools. Two Still Haven't Patched It.

A security researcher sat down last week, opened a popular AI coding assistant, and watched it install a malicious plugin without clicking a single button. No confirmation dialog. No warning. Just silent code execution on a machine with full developer permissions.

The vulnerability is called Plugin4Shell. It affects four of the biggest AI coding agents on the market: Claude Code, OpenAI Codex, GitHub Copilot, and Google's Gemini CLI.

The attack works like this. These tools let developers install plugins "pinned" to a specific version using SHA commit hashes. Sounds secure. But an attacker can create a Git branch whose name matches the plugin's commit hash, hijacking the version check. The tool thinks it's loading the real plugin. Instead, it runs whatever the attacker put there.

No user clicks. No approval prompts. No reinstalls. Just silent execution in an environment that often has access to source code, cloud credentials, SSH keys, and production systems.

Two patched. Two didn't.

Anthropic fixed Claude Code in version 2.1.179. OpenAI patched Codex at v0.146.0. Both responded within days.

GitHub Copilot? No patch. Google's Gemini CLI? Google deprecated the whole thing without issuing a fix.

If your dev team uses Copilot right now, they're exposed. And if anyone still has Gemini CLI installed, same story.

Why this hits harder than a typical security advisory

Most businesses treat AI coding tools like any other developer utility. Install it, forget about it, let the team use it. But these tools run with the same permissions as the developer. An exploit on the tool means an exploit on everything that developer can access.

Think about what a typical developer account touches: private repos, CI/CD pipelines, cloud provider credentials, database connection strings, API keys for third-party services. One compromised coding agent is a skeleton key to the whole stack.

The attack costs under $3,000 to pull off. That puts it within reach of pretty much any motivated attacker.

And then it got worse

In a related incident, security researchers at a startup called Hacktron used Anthropic's Claude Opus 5 to chain two separate vulnerabilities and compromise OpenAI employee accounts. Total cost: under $3,000. Total time: 72 hours.

AI models are now capable enough to automate complex exploit chains. Security research (and attacks) just got cheaper and faster for everyone.

What to do about it

Audit which tools your developers use. Ask directly. Many developers install tools on their own machines without going through IT.

Patch what you can. If your team runs Claude Code or Codex, make sure they're on the latest versions.

Evaluate unpatched tools. If Copilot is in your stack and GitHub hasn't released a fix, that's a risk you need to weigh. Consider pausing use until a patch ships.

Check plugin activity. Look at what plugins your team has installed. Remove anything you don't recognize.

Add MFA everywhere. If a coding agent gets compromised, MFA on your cloud accounts and repos is the difference between a breach and a close call.

AI coding tools are becoming standard infrastructure for dev teams. They need the same security posture as any other critical system. Vendor response time, patching cadence, and permission models should all factor into your evaluation when picking these tools.

The vendors that patched quickly proved they take security seriously. The ones that didn't told you something too.