Plugin4Shell: are Claude Code, Codex, GitHub Copilot or Gemini CLI vulnerable to code execution through a plugin update, and which versions fix it?

Plugin4Shell is a zero-click code execution flaw (disclosed September 2026) in how several AI coding agents install plugin updates: a malicious update to a plugin you already have installed, even one from a reviewed marketplace and pinned as intended, could run code on your machine without any approval prompt. Auto-update (on by default in Claude Code and Codex) made it zero-click. Patch status: - Claude Code: fixed in 2.1.179. Update with claude update. - OpenAI Codex: fixed in 0.146.0. - GitHub Copilot: no fix had shipped at disclosure; check for a newer release and its notes. - Gemini CLI: deprecated by Google instead of patched; move to its replacement. Check and reduce exposure: 1. Update each agent you use and confirm the version. 2. List installed plugins/extensions and remove any you don't actively use; fewer plugins means fewer update channels. 3. For tools still unpatched, turn off automatic plugin updates where possible and only install plugins from publishers you trust. 4. If you suspect a bad update ran, check for unexpected processes, new shell rc or scheduled-task entries, and rotate API keys and tokens stored on the machine. Sources: https://www.helpnetsecurity.com/2026/09/18/plugin4shell-ai-coding-agents-vulnerability/ ; https://cybersecuritynews.com/plugin4shell-zero-click-rce/