September 18, 2026
AI agents run malicious code without a click: AIR finds zero-click RCE
On 17 September, AIR described Plugin4Shell, a zero-click RCE vulnerability affecting Claude Code, Codex, Gemini CLI and GitHub Copilot. A malicious plugin runs with the user's permissions and gains access to files, login data, internal systems and production environments. In Claude Code and Codex, automatic plugin updates are enabled by default, so a substitution requires no new click.
SHA pinning was meant to keep a plugin on the selected commit. AIR showed that the agent fetches code by the pinned SHA but does not verify the commit actually installed. For Gemini CLI, the attack uses the FETCH_HEAD branch. Automatic updates in Claude Code and Codex are enabled by default, so a substitution can run without a new click. Anthropic states that the fix is in version 2.1.179 and advises running `claude update`, or, for Homebrew, `brew upgrade claude-code` or `brew upgrade claude-code@latest`. OpenAI states that the fix is in Codex 0.146.0 and recommends rerunning the installer: `curl -fsSL https://chatgpt.com/codex/install.sh | sh`. For GitHub Copilot, no fix was available when the research was published.
Fixes for Claude Code and Codex have already been identified by version, while GitHub Copilot had no fix as of 17 September.
Source
