Plugin4Shell Zero-Click RCE Hits Major Coding Agents

AIR Security disclosed Plugin4Shell, a zero-click RCE affecting major coding agents including Claude Code and Codex via plugin marketplaces. The flaw highlights a structural gap in AI agent authorization that NIST's new rules have yet to address.

2026-09-20 ~ 2026-09-20 · 2 related posts

• Plugin4Shell zero-click RCE hits Claude Code, Codex, Copilot and Gemini CLI days before NIST IR 8587, exposing the gap in agent authorization — docybo · 2026-09-20
• Plugin4Shell zero-click RCE in Claude Code, Codex and Copilot exposes the agent authorization gap — docybo · 2026-09-20