&imwidth=800&imheight=600&format=webp&quality=medium "One flaw hit all four major AI coding assistants! Two are still unpatched")
A single vulnerability has been found in all four of the most widely used AI coding assistants at once, and it targets the exact mechanism that was supposed to keep them safe.
Researchers named it Plugin4Shell. It affects Anthropic's Claude Code, OpenAI's Codex, GitHub Copilot and Google's Gemini CLI — the tools millions of developers now use to write software with AI help.
What It Does
The flaw allows a malicious plugin update to run attacker-controlled code on a developer's machine without the developer clicking, approving, or reinstalling anything. That combination — no user action required — is what makes it a zero-click vulnerability, the most dangerous kind.
It is being described as the first true supply-chain vulnerability in the AI agent ecosystem: an attack not on the tool directly, but on the trusted software the tool pulls in.
How The Safeguard Was Turned Around
Trending Stories
)
Nigeria: Protesters take to the streets, police fire shots
)
Russia-Europe tensions: Polish PM warns Russian attacks could test NATO's unity
)
Flying cars in UAE: Ras Al Khaimah signs deal with Chinese company to test new transport
Russia attacks Ukraine with 174 drones, kills 8; 2 vessels hit in Black Sea
)
Delhi voter roll shake-up: 3.31 million electors flagged in SIR review
)
Gaza under attack: Health chief's son killed in IDF strikes
)
Raphinha hat-trick powers Barcelona to 3-1 win over Sevilla in La Liga
&im=FitAndFill=(700,400))
How many F-35s does Britain, Japan and Israel have?
)
China may have gained access to US's classified F-35 jets; parts meant for repairs diverted to Hong Kong, sparking Pentagon inquiry
)
Russia's deadly Ukraine strikes kill 2 in Sumy, hit Dnipro mall
)
Trump defends AI amid growing alarm, announces new 'AI force' and promises an 'AI czar'
)
Aravana prasadam shortage at Sabarimala temple in Kerala triggers protests, TDB questioned
)
Cochin shipyard starts building Indian Navy's next-gen missile vessels
)
9 women found dead near Johannesburg: South Africans rally, demand 'enough' to femicide
)
AI actress Tilly Norwood glitches mid-interview, switches from English to Chinese | Watch
)
Kampala-Ankara rift deepens: Uganda suspends military ties, seeks Fred Lumbuye's extradition
)
Trump bans CNN, MS NOW and Politico from White House over ‘FAKE NEWS’
66 years of the Indus Waters Treaty: How India and Pakistan settled a bitter river dispute
)
‘Will go to any extent’: Pakistan vows to defend Saudi Arabia amid Houthi attacks
&im=FitAndFill=(700,400))
‘Not the US or China’: These are the countries leading the world in arable land
)
Arvind Kejriwal, family members, Delhi CM Rekha Gupta get SIR notices
)
EXCLUSIVE | Singer Hanita Bhambri on her Toxic debut, working with Vishal Mishra and more
)
US-Iran war: Tehran draws red lines — seven demands before any peace talks
)
‘End of my career...’: NSA Doval recalls tense Sikkim mission when China captured Indian intelligence team
)
Iran sets 7 conditions to end war with US: What are Tehran’s demands?
)
Reacher star Alan Ritchson opens up about alleged blackmail, suicide attempt during difficult period
)
Mark Carney mimics Trump in hilarious moment over C$70 billion clean-energy investment; room erupts in laughter
)
Harry Brook targets long reign at top of T20I rankings after Sri Lanka sweep
)
Russia holds first parliamentary elections since the beginning of the Ukraine war
&im=FitAndFill=(700,400))
Meet top 5 Indian batters with fastest T20I centuries
)
Saudi vs Houthis: Houthis claim missiles & drones used in attack on key Saudi sites
)
Trump announces ‘AI Force’ as debate grows over AI risks and regulation
)
Report: Iran rebuilding Taleghan 2, nuclear site tied to past weapons research, hit twice by Israel
)
The Verdict | When precision fails: US commits war crime in Minab school strike, UN finds
)
US-Iran war: Tehran sets seven conditions to re-engage in talks with US
)
Ed Sheeran addresses Macklemore's removal, Gaza conflict during Philadelphia concert: 'I cannot hide how I feel'
)
Africa is splitting, and a lot sooner than estimated, giving way to a new ocean
)
Trump 2.0: Dark days ahead for America’s ‘imperial presidency’
)
)
The interesting part is that these tools already had a defence, and the flaw defeats it.
When a plugin is reviewed and approved, marketplaces typically pin it to a specific version using a long code fingerprint — a commit hash — so the tool only ever loads that exact, vetted code. The idea is that even if the plugin's repository is later tampered with, the fingerprint will not match and the bad code will be refused.
The researchers found a way to make the tool load a malicious version while still appearing to honour the approved fingerprint. By creating a branch whose name is identical to the 40-character fingerprint, they exploit how the underlying version-control system resolves names — it can pick the attacker's matching branch name over the genuine approved code, then report the installation as successful.
In short, the tool believes it loaded the approved plugin. It loaded the attacker's instead.
Who Is Patched And Who Is Not
The responses have split the four companies, and that split is the practical story for anyone using these tools.
Anthropic has shipped a fix in Claude Code, and OpenAI has shipped one in Codex. For GitHub Copilot, GitHub says a mitigation exists, but the researchers dispute how much of the problem it actually covers. Google's Gemini CLI is reported as still exposed.
So two of the four are patched, and two are, at best, unresolved. A developer using Copilot or Gemini CLI cannot currently assume the hole is closed.
Why This Category Matters More Than A Normal Bug
A coding assistant is an unusually valuable thing to compromise.
It runs on a developer's machine, often with access to source code, credentials and the ability to run commands. Code that executes inside it inherits much of that reach. A supply-chain attack here is not a nuisance popup — it is a foothold in exactly the environment where software is built, and therefore a potential path into everything that software touches.
This is the same lesson the industry keeps relearning in new clothing: the trusted component you do not think about is the one worth attacking.
What To Watch
Whether GitHub and Google ship unambiguous fixes, and whether the researchers accept them as complete. Whether plugin marketplaces change how they verify code so a fingerprint cannot be spoofed by a branch name. And whether the speed of AI-tool adoption has outrun the security review these tools now clearly need, given that all four shared the same flawed assumption.
