As of 22 September 2026 the Plugin4Shell zero‑click remote‑code‑execution (RCE) vulnerability is still unpatched in GitHub Copilot and the consumer version of Google Gemini CLI, while Anthropic and OpenAI have already released fixes for their respective coding agents.
What the Plugin4Shell flaw does
The vulnerability, discovered by AI‑security firm AIR Security in May 2026, allows malicious marketplace plug‑ins to be auto‑loaded by four major coding assistants – Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI – and execute arbitrary code on developers’ machines. Heise Online reported that the exploit injects code directly into the host computer, bypassing any user interaction.
„Die vier Coding‑Agenten Claude Code, OpenAI Codex, GitHub Copilot und Gemini CLI sind von der Zero‑Click‑RCE‑Sicherheitslücke (Remote Code Execution) Plugin4Shell betroffen, die Schadcode auf die Rechner von Entwicklerinnen und Entwicklern einschleust.“ – Heise Online
Patch rollout across the four agents
According to the same Heise Online article, Anthropic and OpenAI have already delivered patches for Claude Code and OpenAI Codex respectively. In contrast, no fix has been released for GitHub Copilot, and the consumer version of Google Gemini CLI remains permanently vulnerable.
| Company | Coding agent | Patch status |
|---|---|---|
| Anthropic | Claude Code | Patched |
| OpenAI | Codex | Patched |
| Microsoft (GitHub) | Copilot | Unpatched |
| Gemini CLI (consumer) | Unpatched | |
| Source: Heise Online, 22 Sept 2026 | ||
Why the gap matters for developers and enterprises
The four agents collectively power a large share of AI‑assisted software development in the United States and Europe. Developers using Copilot or Gemini CLI today could have malicious code injected without any prompt, potentially compromising proprietary codebases, build pipelines, or even production environments. Because the vulnerability is zero‑click, the attack surface is broader than phishing‑style exploits that require user interaction.
Heise Online notes that AIR Security believes the primary responsibility for remediation lies with the coding‑assistant providers. The lack of a fix from Microsoft and Google therefore leaves a sizable segment of the developer ecosystem exposed for an indeterminate period.
Company background and scale
Anthropic, founded on 26 January 2021, reports roughly 2,500 employees (Wikidata). OpenAI, founded on 11 December 2015, lists about 4,500 employees (Wikidata). Both firms operate primarily in the United States, though the packet does not specify exact headquarters.
Microsoft, the owner of GitHub, disclosed a net income of $133.749 billion for the fiscal year ending 30 June 2026 and total assets of $758.376 billion, according to its Form 10‑K filed 29 July 2026. These figures illustrate the scale of the platform that hosts Copilot and underscore the broader financial stakes of a security breach.
Google’s parent Alphabet did not provide specific financial data in the packet, but the company’s involvement in AI‑driven developer tools places it among the sector’s most valuable players.
Outlook and unanswered questions
The immediate risk is that developers who have not yet migrated to patched agents remain vulnerable. The packet states that Microsoft was notified in June 2026 but has not responded publicly, while Google also received notice at that time. Neither company has confirmed a timeline for a fix.
Open questions include:
- When, if ever, will Microsoft release a patch for Copilot?
- Will Google address the vulnerability in the consumer Gemini CLI, or only in an enterprise‑grade version?
- How many active developers are currently using the unpatched agents?
Until patches are deployed, enterprises that rely on Copilot or Gemini CLI may need to consider temporary mitigation steps, such as disabling automatic plug‑in loading or restricting the use of these assistants in sensitive codebases.
Heise Online’s coverage, published on 22 September 2026, remains the sole verification of the current patch landscape. No contradictory evidence was found.