A zero‑click vulnerability, dubbed Plugin4Shell, affects major AI coding agents from Anthropic, OpenAI, Google, and Microsoft, enabling full remote code execution via plugin supply‑chain attacks.

A newly disclosed zero‑click vulnerability, dubbed Plugin4Shell, lets attackers achieve full remote code execution on AI‑driven coding assistants from Anthropic, OpenAI, Google and Microsoft without any user interaction.

What is Plugin4Shell?

Plugin4Shell exploits the way coding agents retrieve and execute third‑party plugins. By injecting malicious code into a plugin’s metadata, an attacker can trigger execution directly from the agent’s backend, bypassing the usual sandbox checks.

Affected platforms

  • Anthropic’s Claude‑based coding assistant
  • OpenAI’s Codex and ChatGPT‑plus code mode
  • Google’s Gemini Code
  • Microsoft’s Copilot for Visual Studio

All four services share a common plugin architecture that fetches extensions from a central repository. The flaw resides in the repository’s validation routine, which fails to sanitise specially crafted manifest entries.

How the attack works

An attacker publishes a malicious plugin that appears legitimate. When a coding agent queries the repository, the malformed manifest is parsed and executed on the provider’s servers, granting the attacker arbitrary code execution privileges.

Because the exploit requires no user click or prompt, it is classified as a zero‑click remote code execution (RCE) flaw, giving threat actors a “keys to the kingdom” level of access to the underlying infrastructure.

Mitigation steps

Vendors have responded by temporarily disabling external plugin loading and issuing patches to tighten manifest validation. Users are advised to disable third‑party plugins until the updates are deployed.

Security researchers recommend monitoring network traffic for unexpected outbound connections from coding agents and applying strict egress controls in enterprise environments.

The Register’s coverage of the Plugin4Shell vulnerability provides further technical details and vendor statements.