{"slug": "plugin4shell-your-ai-coding-agents-plugin-store-is-an-rce", "title": "Plugin4Shell: Your AI Coding Agent’s Plugin Store Is an RCE", "summary": "A zero-click remote code execution vulnerability dubbed Plugin4Shell affects AI coding agents Claude Code, Codex, Copilot, and Gemini CLI through a SHA pinning bypass, according to byteiota. The report urges users to check patch status and act immediately.", "body_md": "Plugin4Shell is a zero-click RCE hitting Claude Code, Codex, Copilot, and Gemini CLI via SHA pinning bypass. Check patch status and act now.\n\nThe post \nPlugin4Shell: Your AI Coding Agent’s Plugin Store Is an RCE\n appeared first on \nbyteiota\n.", "url": "https://wpnews.pro/news/plugin4shell-your-ai-coding-agents-plugin-store-is-an-rce", "canonical_source": "https://byteiota.com/plugin4shell-your-ai-coding-agents-plugin-store-is-an-rce/", "published_at": "2026-09-30 02:09:50+00:00", "updated_at": "2026-09-30 02:17:07.867488+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "ai-tools", "developer-tools"], "entities": ["Plugin4Shell", "Claude Code", "Codex", "Copilot", "Gemini CLI", "byteiota"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/plugin4shell-your-ai-coding-agents-plugin-store-is-an-rce", "markdown": "https://wpnews.pro/news/plugin4shell-your-ai-coding-agents-plugin-store-is-an-rce.md", "text": "https://wpnews.pro/news/plugin4shell-your-ai-coding-agents-plugin-store-is-an-rce.txt", "jsonld": "https://wpnews.pro/news/plugin4shell-your-ai-coding-agents-plugin-store-is-an-rce.jsonld"}}