Plugin4Shell Bug Hit AI Coding Agents A flaw in Codex, Claude Code, Gemini CLI and Copilot let attackers swap a trusted plugin for malicious code, no developer click required.