Plugin4Shell is a zero-click RCE affecting AI coding agents, including Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI, via malicious plugin updates.