If your team runs any AI coding assistant, this week's disclosure deserves five minutes of your attention.
What's happening
On September 18, independent security researchers at AIR Security published details of Plugin4Shell, a zero-click remote code execution flaw they discovered across four of the most popular AI coding tools: Claude Code, GitHub Copilot, Codex, and Gemini CLI.
The phrase "zero-click" is the part worth sitting with. You do not need to download anything new, approve a strange file, or click a bad link. The attack exploits how these tools verify plugin updates. An attacker can push a malicious plugin version that slips past the SHA integrity checks the tools use for version pinning. The assistant then silently runs attacker-controlled code the next time it updates. AIR found the flaw in May, gave all four vendors a 90-day disclosure window, and published when time ran out.
Why it matters for a small team: your AI coding assistant runs with your permissions on your machine. It can read source code, cloud credentials, SSH keys, and any API tokens sitting in your environment. Two of the four vendors shipped fixes. Microsoft has not patched GitHub Copilot. Google chose to formally deprecate Gemini CLI rather than patch it, leaving every existing install permanently exposed. Help Net Security has full disclosure details including patch versions and current status by vendor.
Try this this week
- Claude Code: update to version 2.1.179 or later. Check with
claude --version. - Codex: update to version 0.146.0 or later.
- GitHub Copilot: disable any third-party Copilot extensions until Microsoft ships a fix. The base chat functionality is not the attack surface; installed extensions are.
- Gemini CLI: uninstall it. No fix is coming.
- Rotate secrets: any API keys, cloud credentials, or SSH keys accessible from machines where you run these tools should be rotated, especially anything long-lived.
- Audit your plugins: check what is installed in your AI tool and remove anything you do not recognize or no longer actively use. A smaller footprint is a safer footprint.
The bigger picture
Plugin4Shell is the first confirmed supply chain attack targeting AI coding agents as a category, not as an incidental target. The lesson for a small team is straightforward: AI tools that touch your code and run on your machine are now a real security surface, exactly like a browser extension or an npm package. Know what is installed, keep it updated, and strip out plugins you are not actively using. The smallest working setup is almost always the safest one, and that principle holds whether you are a solo dev or a three-person shop.