Zero-click RCE. Four major AI coding agents. No user interaction required. Let's talk about Plugin4Shell. The Incident In September 2026, researchers disclosed a vulnerability class dubbed "Plugin4Shell" affecting Claude Code, Codex, Gemini CLI, and Copilot. The flaw lives in how these agents verify SHA-pinned plugin commits pulled from marketplaces. Here's the setup: you install a plugin, the agent pins it to a specific commit SHA, and in theory that SHA is your guarantee tha...