Published Friday, September 18, 2026 at 05:37 AM PT

<strong>BREAKING: Zero-Click RCE in Four Major AI Coding Agents; Two Remain Unpatched</strong>

BLUF: A zero-day remote code execution vulnerability affecting four leading AI coding agents has surfaced. Two vendors have not yet released patches. Immediate action required: identify which agents are in use in your CI/CD and development environments and isolate them pending vendor guidance. No authentication required for exploitation.

DETAILS

  • Confirmed: Zero-click RCE flaw disclosed targeting four major AI coding agents (specific vendors unconfirmed from available material).
  • Patch Status: Two of the four affected agents remain unpatched; two others have addressed the flaw (patch availability/timeline not specified in available reporting).
  • Attack Surface: Vulnerability is zero-click — no user interaction required for remote code execution.
  • Classification: Zero-day vulnerability; multiple security news outlets (news4hackers, Help Net Security, The Register) are reporting the same incident.
  • Status: This is an active disclosure with incomplete public information. Vendor statements and CVE details are not yet in available material.

IMPACT

  • Scope: Any organization running unpatched versions of the four affected AI coding agents in development pipelines, local workstations, or CI/CD infrastructure.
  • Severity: High to Critical — RCE grants attacker code execution at the privilege level of the affected process, potentially providing access to source code, credentials, build artifacts, and downstream systems.
  • Urgency: Two of four agents lack patches, placing organizations on those versions at immediate risk.

RECOMMENDED ACTIONS

  1. Inventory immediately: Identify which AI coding agents (if any) are deployed in your infrastructure. Cross-reference against the four known-affected vendors once vendor statements clarify which they are.
  2. Isolate unpatched instances: If running any of the two unpatched agents, take them offline or air-gap them from production CI/CD and credential stores until patches are released.
  3. Watch for patches: Monitor the affected vendors’ security advisories over the next 24–72 hours for CVE numbers, CVSS scores, and patch availability.
  4. Assume compromise if exposed: Any agent instances exposed to untrusted network input should be treated as potentially compromised; rotate credentials and audit recent build logs.

SOURCES

  • news4hackers: “Zero-Click RCE Vulnerability in Four Major AI Coding Agents, Two Unpatched”
  • Help Net Security: “Zero-click RCE vulnerability hit four major AI coding agents, two remain unpatched”
  • The Register: “AI coding agents’ 0-click RCE flaw could hand attackers keys to the kingdom”

NOTE: Specific vendor names and CVE identifiers not confirmed in available material. Update this alert once vendor disclosures provide technical details.

Recent high-severity events at publish time:

Recent high-severity events