{"slug": "zero-click-rce-vulnerability-hit-four-major-ai-coding-agents-two-remain", "title": "Zero-click RCE vulnerability hit four major AI coding agents, two remain unpatched", "summary": "A zero-click remote code execution vulnerability affects four major AI coding agents — Claude Code, Codex, GitHub Copilot and Gemini CLI — and two of them remain unpatched, according to security researchers at AIR. AIR called it \"the first supply chain vulnerability of the AI agent ecosystem,\" warning that anyone running a major coding agent that installs plugins from a marketplace is exposed, with an attacker gaining the same reach into company systems and data as the employee running the agent.", "body_md": "Four major AI coding agents, Claude Code, Codex, GitHub Copilot and Gemini CLI, all share the same zero-click RCE vulnerability, one that could give an attacker the same reach into a company’s systems and data as the employee running the agent, according to AIR. “It is the first supply chain vulnerability of the AI agent ecosystem,” the researchers said. “Anyone running a major coding agent that installs plugins from a marketplace is exposed. The exposure … [More](https://www.helpnetsecurity.com/2026/09/18/plugin4shell-ai-coding-agents-vulnerability/) \n\nThe post [Zero-click RCE vulnerability hit four major AI coding agents, two remain unpatched](https://www.helpnetsecurity.com/2026/09/18/plugin4shell-ai-coding-agents-vulnerability/) appeared first on [Help Net Security](https://www.helpnetsecurity.com).", "url": "https://wpnews.pro/news/zero-click-rce-vulnerability-hit-four-major-ai-coding-agents-two-remain", "canonical_source": "https://www.helpnetsecurity.com/2026/09/18/plugin4shell-ai-coding-agents-vulnerability/", "published_at": "2026-09-18 08:49:00+00:00", "updated_at": "2026-09-18 09:22:58.544096+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-tools", "developer-tools"], "entities": ["Claude Code", "Codex", "GitHub Copilot", "Gemini CLI", "AIR", "Help Net Security"], "alternates": {"html": "https://wpnews.pro/news/zero-click-rce-vulnerability-hit-four-major-ai-coding-agents-two-remain", "markdown": "https://wpnews.pro/news/zero-click-rce-vulnerability-hit-four-major-ai-coding-agents-two-remain.md", "text": "https://wpnews.pro/news/zero-click-rce-vulnerability-hit-four-major-ai-coding-agents-two-remain.txt", "jsonld": "https://wpnews.pro/news/zero-click-rce-vulnerability-hit-four-major-ai-coding-agents-two-remain.jsonld"}}