AI coding agents' 0-click RCE flaw could hand attackers keys to the kingdom