Plugin4Shell hits four coding agents

Air says Plugin4Shell is a zero-click supply-chain flaw affecting four major coding agents: Claude Code, Codex, Gemini CLI, and Copilot. Air’s disclosure says Anthropic patched Claude Code in 2.1.179 and OpenAI patched Codex in 0.146.0; The Register’s report says Google will not patch deprecated Gemini CLI and Microsoft Copilot’s fix remains unresolved. Teams that let agents install marketplace plugins should inventory versions and treat provenance guarantees as unproven until agent-side fixes land, alongside the archive’s warning about unowned AI documentation links.