---
format: "aidr-story-markdown/v1"
id: "62c3e330d01a3ddfb02a19eca4cbdbae2a208cc279bd281b24d998efc1f00264"
canonical_url: "https://aidr.today/62c3e330?lang=en"
title: "Plugin4Shell Zero Click Flaw Hits 4 AI Coding Agents Including Copilot"
lang: "en"
requested_lang: "en"
available_langs: ["en","vi"]
translation_fallback: null
fallback_fields: []
published_at: "2026-09-20T14:38:48.000Z"
category: "Legal"
topics: ["security","copilot","plugin4shell","vulnerability","coding-agents","coding","claude-code","codex"]
source_urls: ["https://marketbrief.now/cybersecurity/plugin4shell-zero-click-flaw-hits-4-ai-coding-agents-including-copilot-940e6deb","https://huggingnews.com/cybersecurity/plugin4shell-zero-click-flaw-hits-4-ai-coding-agents-including-copilot-940e6deb","https://x.com/theinformation/status/2101672773215039962","https://x.com/krushalkalkani/status/2101669015307288966","https://x.com/BulsTheRock/status/2101546201107866017","https://x.com/ankurinnovator/status/2101633912783229333","https://huggingnews.com/cybersecurity/plugin4shell-zero-click-rce-bypassed-sha-pinning-on-4-leading-ai-agents-68dcb247","https://marketbrief.now/cybersecurity/plugin4shell-zero-click-rce-bypassed-sha-pinning-on-4-leading-ai-agents-68dcb247"]
summary: "A remote code execution vulnerability allows attackers to target developer machines via compromised plugin updates for a group of leading AI coding assistants.…"
---

# Plugin4Shell Zero Click Flaw Hits 4 AI Coding Agents Including Copilot

> [Open the canonical story](<https://aidr.today/62c3e330?lang=en>)

**Published:** 2026-09-20T14:38:48.000Z
**Category:** Legal
**Topics:** security, copilot, plugin4shell, vulnerability, coding\-agents, coding, claude\-code, codex

## Summary

A remote code execution vulnerability allows attackers to target developer machines via compromised plugin updates for a group of leading AI coding assistants\.…

## Sources

- [Story source](<https://marketbrief.now/cybersecurity/plugin4shell-zero-click-flaw-hits-4-ai-coding-agents-including-copilot-940e6deb>)
- [Story source](<https://huggingnews.com/cybersecurity/plugin4shell-zero-click-flaw-hits-4-ai-coding-agents-including-copilot-940e6deb>)
- [Story source](<https://x.com/theinformation/status/2101672773215039962>)
- [Supporting source](<https://x.com/krushalkalkani/status/2101669015307288966>)
- [Supporting source](<https://x.com/BulsTheRock/status/2101546201107866017>)
- [Supporting source](<https://x.com/ankurinnovator/status/2101633912783229333>)
- [Story source](<https://huggingnews.com/cybersecurity/plugin4shell-zero-click-rce-bypassed-sha-pinning-on-4-leading-ai-agents-68dcb247>)
- [Story source](<https://marketbrief.now/cybersecurity/plugin4shell-zero-click-rce-bypassed-sha-pinning-on-4-leading-ai-agents-68dcb247>)