The security promise was simple. A plugin marketplace reviews a piece of code, locks it to a specific, verified version, and every AI coding agent that installs it gets exactly what was reviewed. No surprises or swaps. That promise just got broken, simultaneously, across every major AI coding agent on the market. On September 17, cybersecurity startup AIR Security publicly disclosed Plugin4Shell, a zero-click, high-severity remote code execution vulnerability affecting Anthropic's Claude Code, OpenAI's Codex, Microsoft's GitHub Copilot, and Google's Gemini CLI. The name is a deliberate echo of Log4Shell, the 2021 Apache flaw that shook enterprise security teams for months. This one hits a faster-moving target: the plugin ecosystems that have quietly become critical infrastructure for millions of software developers. The researchers who found it, Or Nevo, Dor Granat, and Niv Hoffman, describe it as the first supply-chain vulnerability of the AI agent ecosystem. That is not a small claim, and the technical details back it up. How the Attack Works To understand Plugin4Shell, you need to understand SHA pinning, the mechanism it breaks. When a marketplace approves a plugin, it records a cryptographic commit hash, a 40-character string that uniquely identifies an exact snapshot of the plugin's code. From that point forward, every agent that installs the plugin is supposed to check out precisely that commit. Reviewed code, nothing else, forever. The vulnerability is a single missing verification step. Affected agents fetch the pinned commit during installation but never confirm that the code they actually land on matches it. That gap opens the door to a Git reference resolution trick. For Claude Code, Codex, and GitHub Copilot, an attacker who controls a plugin repository can create a branch whose name is the exact 40-character pinned commit hash, set it as the repository's default branch, and point it at malicious code. When the agent runs its checkout, Git resolves the branch name instead of the commit object, because Git prefers a matching reference when the name is ambiguous. The agent installs attacker-controlled code, reports a clean install at the trusted hash, and nothing looks wrong. Gemini CLI has a slightly different variant. Its installer fetches the target commit and then checks out FETCH_HEAD, but if the repository's default branch is itself named FETCH_HEAD, that checkout resolves to the branch instead. The fetched commit gets silently discarded. What makes this zero-click is auto-update. Claude Code and Codex update installed plugins in the background by default. When a plugin's pinned commit is swapped upstream, an already-installed, already-trusted plugin gets silently replaced with a malicious version. No prompt. No reinstall. Nothing for the user to notice or decline. Plugins run with the permissions of the developer operating the agent. That means an attacker who succeeds here lands in the developer's machine with access to source code, cloud credentials, SSH keys, internal repositories, and production systems. The Context Makes It Worse Plugin4Shell is the third installment in a series of findings from AIR Security, each one showing a different layer of the AI plugin ecosystem collapsing under scrutiny. In earlier research called "The Story of Skills," the team published a malicious skill to a trusted marketplace and watched it spread to over 26,000 agents. In SkillJacking, they found 925 skills already in active use had been quietly hijacked from their original maintainers, affecting 134,000 agents, by taking over the repositories behind them. The industry's answer to SkillJacking was SHA pinning. Plugin4Shell is the answer to that answer. The takeovers AIR demonstrated in SkillJacking can now be combined with Plugin4Shell to bypass the exact safeguard that was supposed to contain them. The chain is proven end to end. Vendor Responses AIR found the vulnerability in May 2026, built working proof-of-concept exploits against all four agents, and disclosed everything to the vendors in June. What happened next drew a clear line between the companies that acted and the ones that did not. Anthropic patched Claude Code in version 2.1.179. OpenAI patched Codex in version 0.146.0. Both confirmed fixes after disclosure. Microsoft has not shipped a fix for GitHub Copilot. GitHub has argued that its platform blocks branch and tag names that resemble commit hashes, which limits the attack surface for GitHub-hosted plugins. AIR's counter is that Copilot also supports marketplaces hosted on Bitbucket and self-hosted git servers, which permit such names, and that GitHub's restriction does nothing for those configurations. The two positions describe different scopes. Copilot users currently have no patch. Google's response was to deprecate Gemini CLI entirely. The company confirmed in August that no fix would ship, directing users to migrate to an alternative product called Antigravity. Every existing Gemini CLI installation remains permanently vulnerable. What Users Should Do Now The fix, technically, is a single line of verification that every affected agent was missing: after checkout, compare the actual HEAD commit against the pinned hash and abort if they do not match. Because the check runs inside the agent rather than at the marketplace, no marketplace can enforce this guarantee on its own. Only an agent-side fix closes it. Claude Code users should update to version 2.1.179 or later. Codex users should update to version 0.146.0 or later. Gemini CLI users should migrate away from the product. GitHub Copilot users have no patch available and no confirmed timeline for one. For enterprise teams that have built internal vetting processes around SHA pinning, Plugin4Shell is a harder problem. The review passed. The pin was written. Different code got installed. Every downstream security process built on that guarantee inherits the failure. The most striking detail in AIR's disclosure is not the vulnerability itself. It is that four independent engineering teams at four separate companies all made the same mistake, building the same flawed assumption into their auto-update pipelines, and none of them caught it until an outside lab did. That is not an implementation error in one product. That is a design assumption the entire industry shared, and nobody questioned it.

Open-source subagent-native coding agent

Meta has launched Muse Code in beta, a terminal AI coding agent powered by Muse Spark 1.2 with persistent subagents, crash recovery and repository-scale execution.

Multi-agent AI coding orchestrator

In OpenAI Codex, security researchers have identified two sandbox escape vulnerabilities, one of which allows developers to execute commands on their machine without prompting them. The vulnerabilities, Heapjack and Overpatch, affect different parts of the coding agent's security boundary.  The vulnerability was reported to OpenAI by Accomplish AI on August 12. According to the researcher, Codex fixed both issues within eight days. The more serious Heapjack vulnerability demonstrated that malicious code could move beyond the restrictions imposed by Codex's sandbox, even when the agent was running as a read-only application.  Heapjack Breaks the Sandbox Boundary The node_repl component installed with Codex Desktop is targeted by heapjack. Although both OpenAI and untrusted agent code are run in separate JavaScript contexts, both operate within the same Node.js process and share the same memory heap, the separation was not sufficiently effective in preventing a security token from coming into contact with an untrusted environment.  By inspecting the process heap, it was possible to obtain the token generated for the trusted context that remained in shared memory. When the token was obtained, the untrusted code could interact with a native parent process outside the sandbox using the communication channel used by the trusted context. As part of the demonstration of the technique, the researchers launched an application outside of Codex's process tree by utilizing the open command.  A Unix socket as well as other system-level interfaces could also be reached through this access. This demonstration was especially important since it occurred while Codex was running in a strict read-only sandbox mode, where the agent was not expected to have any writing access to the wider system.  The attack could be triggered by a seemingly routine development process. The researchers demonstrated a scenario in which malicious content contained in a repository, created by a third party, could exploit the vulnerability after the repository was opened in Codex and a query about its code was made.  Overpatch Expands Write Access Second, a vulnerability known as Overpatch affects the open-source Codex command line utility, and it takes an alternative route outside the sandbox. The vulnerability affects the application_patch tool used by Codex to modify files.  In workspace-write mode, Codex is intended to limit file changes to the project directory. Researchers discovered that apply_patch, instead of expanding write permissions, could expand them based on paths included in patches. By using a path such as /tmp, the tool was able to treat the root of the file system as an accessible parent directory. In addition to the permission extension, researchers modified .zshrc by creating a symbolic link to the user's home directory so that it would be modified as well. A successful write was not required for the /tmp entry; its presence extended the permissions granted to the patch operation. A modified shell configuration resulted in a file modification outside of the permitted workspace without an approval prompt. When a new terminal session was launched, attacker-controlled content ran.  Two Flaws, One Security Boundary Problem It is important to note that though Heapjack and Overpatch affect different parts of the Codex, both expose weaknesses in the way in which the security boundary of the agent was enforced. In the case of Overpatch, the tool responsible for applying changes also determined the scope from which it had access to data.  In heapjack, trust boundaries were similarly compromised, as the token separating trusted and untrusted execution remained accessible in the same Node.js process and memory space as the untrusted code. The findings suggest that AI coding agents can be restricted in other ways than just controlling their abilities to execute commands.  Untrusted agent activity must also be prevented from influencing the mechanisms that enforce those restrictions by the tools, processes and interfaces surrounding the model. On August 12, 2026, OpenAI was notified of the issues, and they were both addressed within eight days by Accomplish, who stated that Overpatch was addressed in Codex CLI 0.149.0, while Heapjack had been addressed in Codex Desktop build 26.818.21641. A later statement by OpenAI confirmed that both issues had been resolved in August, and that additional measures were being taken to strengthen file-write controls and expand sandbox testing across platforms. These findings emphasize the security challenges associated with maintaining strong isolation in AI coding environments. Codex Desktop and Codex CLI have been updated to address both vulnerabilities.

  AI agents capable of identifying malicious software can be manipulated by the AI Now Institute to execute it, according to new research. The proof-of-concept attack, known as "Friendly Fire," demonstrates that autonomous AI coding agents, such as Claude Code from Anthropic and Codex from OpenAI, can be deceived into running malicious code while performing open-source security reviews.  AI agents can approve and execute commands independently of the user without requiring user confirmation for every action, which is what this attack targets. Researchers contend that the vulnerability does not lie in the software version used by these agents, but rather in the way they interpret and react to instructions embedded within untrusted repositories rather than exploiting a software vulnerability.  A comparison with conventional supply-chain attacks that hide malicious code within a repository was made by the researchers, who noted that when static analysis and manual review are performed, the repository itself can appear to be completely free of malicious code. By introducing the malicious payload at execution time, the AI agent follows embedded instructions, so traditional security tools cannot detect this technique. By adding a seemingly harmless README.md instruction to an open-source project that recommended running a script entitled security.sh before submitting a pull request, attackers modified it. By launching a malicious binary hidden within a legitimate compiled Go file, the script silently executed on the host computer without triggering security warnings or approval prompts, allowing the malicious binary to execute on the system.  According to the researchers, the attack is successful because the AI agent recognizes the instructions as a legitimate step in the process of installing software rather than an attempt to exploit the system maliciously. Once the recommended script has been executed, the payload will run under the same permissions that were provided for the developer or AI agent, potentially exposing credentials, environment variables, and other sensitive information.  The procedure differs from previous prompt injection attacks, which relied on configuration files and often generated trust warnings, as this technique hides instructions inside standard documentation that is regularly read by developers and AI agents. It has been reported that both Claude Code and OpenAI Codex followed the embedded instructions during testing, while newer AI models executed the disguised binary upon detecting differences between the source file and the compiled executable.  A laboratory proof-of-concept has been demonstrated, with no evidence of active exploitation in the field. In addition to excluding the malicious payload, the publicly released demonstration code does not attempt privilege escalation or lateral movement. These findings indicate that autonomous AI agents pose a greater challenge in terms of design rather than a problem that can be resolved by simply updating software.  It is becoming more common for organizations to employ AI-powered coding assistants to review third-party software. Researchers recommend treating AI coding agents as privileged software, rather than simply assistants. Autonomous agents should not be permitted to execute commands on untrusted repositories, least-privilege access policies should be enforced, AI workflows should be isolated in sandboxed environments, and human approval should be required before running scripts or binaries recommended by project documentation.  In accordance with the researchers, the issue is not related to any particular AI model, but a broader trust problem affecting autonomous coding assistants capable of executing shell commands. In addition to creating new attack surfaces if they are unable to reliably distinguish legitimate instructions from content controlled by the attacker, AI agents are becoming increasingly capable of cloning repositories, installing dependencies, and resolving setup issues independently.  As autonomous AI systems are increasingly adopted in the software development and cybersecurity sectors, prompt injection attacks remain a major security threat. This study adds to a growing body of evidence that prompt injection attacks remain one of the greatest security risks. In light of the increasing autonomy of AI agents, organizations must balance automation and strong oversight in order to balance automation and security workflows.  AI-driven attack techniques cannot be effectively countered until artificial intelligence (AI) systems can reliably discriminate between trusted and malicious instructions. Human verification and secure execution environments will therefore remain critical safeguards.

IDE for running parallel AI coding agents