| Hey there 👋 I went looking for the catch in the Plugin4Shell writeup, and it is worse than the headline. The safety story for coding-agent plugins was SHA pinning: lock a plugin to one reviewed version, and nothing changes under you. Plugin4Shell walks straight through that. A poisoned plugin update runs code on your machine with no click, no approval, no reinstall. Here is my bias, for what it is worth. Pinning was never a security control, it was a changelog we kept calling a lock. The four biggest coding agents all made that bet, and it broke in the same place at the same time. So today opens on the plumbing, not a launch.
The Big Thing One bad update owns Claude Code, Codex, GitHub Copilot, and Gemini CLI The safety pitch for coding-agent plugins rested on SHA pinning. You lock a plugin to one reviewed commit, and the version you audited is the version that runs. AIR Security spent May turning that promise into a working exploit against the four agents most builders live in: Anthropic’s Claude Code, OpenAI’s Codex, GitHub Copilot, and Google’s Gemini CLI. They call it Plugin4Shell. The break is that a plugin update slips past the pin. A poisoned update runs attacker code on the developer’s machine with no click, no approval prompt, and no reinstall. Zero interaction. The Register’s phrase for the blast radius was keys to the kingdom, and it fits: a coding agent already holds your repo access, your shell, and whatever tokens you handed it. This is the first real supply-chain vulnerability of the agent ecosystem, and it landed the way Log4Shell did. One shared assumption, copied across every major implementation, wrong in the same place. AIR disclosed to all four vendors in June. Anthropic patched Claude Code in August, and OpenAI has since fixed Codex. As of Help Net Security’s writeup on the 18th, Copilot and Gemini CLI were the two still exposed. Microsoft has not shipped a fix, and the mitigation is narrow: GitHub.com blocks branch names that look like commit hashes, so plugins hosted there are shielded, but Copilot stays exploitable when it pulls plugins from Bitbucket or a self-hosted Git server. Google is not patching Gemini CLI at all; it says the tool is deprecated and points users to Antigravity. If you run any of these in CI, let them auto-update plugins, or handed one a broad token, the exposure is not hypothetical. An agent that pulls a compromised plugin on Monday is running someone else’s code inside your build by Monday afternoon, and the pin you trusted is the thing that told you not to look. Ship it? This is a patch-now, not a deploy. Update Claude Code and Codex to their patched builds today. GitHub Copilot has no fix, and it stays exposed when it loads plugins from Bitbucket or self-hosted Git, so restrict its plugin sources to GitHub and freeze updates until Microsoft ships a patch. Google is deprecating Gemini CLI instead of fixing it, so move that work to a supported agent. Either way, treat a plugin update as remote code execution, because that is what it is: gate it behind review, and scope agent tokens so a hijacked plugin cannot reach production secrets. Sources: AIR Security disclosure; The Register (Sep 17); Help Net Security (Sep 18). Two of the four still unpatched at that writing; check each vendor’s release notes.
Tour de Headlines 📊 HubSpot showed the first honest agent-adoption numbers. At its Analyst Day inside UNBOUND in Boston on Sep 17, HubSpot put agents at the center of its CRM story: the Aviator platform, a Growth Context graph, new Campaign, Content, Nurture, and Revenue agents, and an Agent Hub to keep the sprawl manageable. The part worth reading is the usage. HubSpot said 19% of its Pro Plus customers used agents in August, double the share at the start of the year, with monthly agentic actions up 3.5x and credit consumption more than doubling even after an April price cut. Two Breeze agents already run on outcome-based pricing: a dollar per recommended lead for the Prospecting Agent, fifty cents per resolved conversation for the Customer Agent. These are HubSpot’s own figures, presented to investors with a margin story attached, so grade them as vendor numbers. But a real percentage of a big install base, plus a price you only pay when the agent does the job, is the closest thing to an honest adoption signal anyone has shipped this quarter. 🧭 Apple put an agent-drivable browser on every updated Mac. Safari 27, which shipped Sep 14 alongside macOS 27, is the first major consumer browser with a native Model Context Protocol server built in. It runs locally as a stdio subprocess, makes no network calls to Apple, and exposes roughly 17 tools: DOM access, network visibility, runtime evaluation, screenshots. Any MCP client, including Claude Code, Codex CLI, Gemini, or Cursor, can drive your live browser and keep your existing logins. You turn it on under Settings, Developer, “Allow remote automation and external agents.” The catch, flagged by Forkast, is that there is no MDM control to disable it centrally, so it is a per-user developer toggle rather than something IT can switch off across a fleet. For a builder it is a free local browser for your agents. For whoever runs your Macs it is a new automation surface that arrived without an off switch, and it belongs in this week’s threat model. 🏠 Google’s friendliest agent this week fills out permission slips. Google Labs expanded CC on Sep 17 from a personal assistant into a shared household agent. It runs from its own Google account, supports up to six family members who each choose what to share, and sends a shared “Your Day Ahead” brief every morning showing who needs to be where and what the agent already handled. It drafts meal plans, packing lists, and budgets as Google Docs or Sheets, and it will fill out school permission slips and activity registration PDFs. This is consumer, experimental, and a watch rather than a deploy. It earns the slot as contrast: the same week a coding agent got a zero-click RCE and Apple wired an off-switch-less agent into Safari, the launch that felt safest was the one that owns the boring logistics, not the code.
| Sponsor Your team’s calls are full of signal. Measure it. RapportScore reads the calls your team already records and scores how your people communicate: talk ratio, questions asked, trust signals. Deterministic measurement, not vibes. See where a rep is losing the room before the deal does. See your team’s score → |
Tool of the Day 🐝 Swarms Reproducible multi-agent runs with a cost-and-failure trail per task. Swarms pushed a big platform update on Sep 19: an Auto Agent Builder that turns a one-line task into a full roster of configured agents, a multi-agent Chat, batch runs of up to 500 tasks, a hosted MCP page, an encrypted private Skills library, and a “page per completion” permalink so you can trace cost and failure for each task instead of guessing at a bill. It is for teams stitching multi-agent workflows who want per-task cost attribution and an audit record without wiring five tools together. Honest caveat: the feature list is the project’s own changelog. Pilot it on 10 to 50 tasks and confirm that batch cost attribution and retry behavior match your accounting before you trust it in production. Read the changelog →
Worth a Click
Strip the logos off the week and it is one story: the parts of the stack nobody filed under attack surface just became attack surface. A plugin update. A browser you already had open. The vendors spent the same week reporting adoption percentages. Both are true. Only one of them is a to-do this morning. That’s the stack for today. Go pin your plugins, then go check the pin held.
— Ron |
