Tootfinder

Plugin4Shell: #ZeroClick RCE Vulnerability found in top 4 most popular coding agents, millions of agents affected
#Plugin4Shell is a zero-click, high-severity #RCE affecting all four major

Plugin4Shell - Zero Click RCE Vulnerability found in top 4 most popular coding agents, millions of agents affected
Plugin4Shell is a zero-click, high-severity RCE affecting all four major AI coding agents - Claude Code, Codex, Copilot, and Gemini. In this first-of-its-kind AI supply-chain attack, a trusted plugin is silently swapped for a malicious one and auto-installed past the agent's SHA pinning - a flaw no marketplace can fix, so users must update their agent.