Noesion Radarnoesion.ai
Incident2026-09-17

Air Security found Plugin4Shell, a zero-click RCE in coding agents. It lets attackers swap trusted plugins for malicious ones. The flaw bypasses SHA pinning in all four major agents. Auto-updates spread the malicious plugin without user action. Claude Code and Codex have patches. GitHub Copilot has no fix yet. Google deprecated Gemini CLI and will not patch it. Users must update their agents to stay safe.

What changed

Agents trusted SHA pinning to prevent malicious plugin swaps.

What it unlocks

Attackers can silently replace trusted plugins with malicious ones via auto-update.

  • 4 major coding agents affected
  • millions of agents exposed
  • Claude Code patched in 2.1.179
  • Codex patched in 0.146.0

What you need to act on it

  • a plugin installed from a marketplace
  • agent auto-update enabled

Sources

Send this to someone who needs it

Shares the story and its sources. Nothing about you.

What does this mean for your job?

This is the story as everyone gets it. Once a week we send you the version written for your role — what changed, why it matters for the work you actually do, and one thing to try. Free while we tune it.