Zero-click RCE vulnerability hits four major AI coding agents; two remain unpatched
A zero-click remote code execution vulnerability affected four major AI coding agents, and two of them have not yet received a fix. The news appeared on 18 September.
Who is affected and how
- senior developer
- Unpatched agents should not be run on untrusted repositories or inputs.
Sources
- Zero-click RCE vulnerability hit four major AI coding agents, two remain unpatchedhelp net security · Sep 18, 2026
- Zero-click RCE vulnerability hit four major AI coding agents, two remain unpatched | Cyber Security Newssecuritynews.ch · Sep 18, 2026
- One flaw hit all four major AI coding assistants! Two are still unpatchedwion · Sep 20, 2026
Machine-generated summary based on the titles and excerpts of the source articles. The facts come from the linked article.