Daily AI brief · September 18, 2026
Plugin4Shell Hits Four AI Coding Agents at Once
A zero-click flaw let tampered plugins run code inside Claude Code, Codex, Copilot and Gemini CLI, on a day when Gemini and Claude both showed how far AI can get into real systems.
Plugin4Shell: zero-click code execution in four AI coding agents (Help Net Security, AIR Security) AIR Security disclosed a flaw that breaks SHA pinning, the mechanism meant to lock an installed plugin to a reviewed version. An attacker can create a branch name that looks like a commit hash, and because Claude Code and Codex auto-update plugins in the background by default, the swapped code reaches machines with no user action. Researchers say 925 skills were hijacked and reached about 134,000 agents. Anthropic patched Claude Code in 2.1.179 and OpenAI patched Codex in 0.146.0; Google said Gemini CLI is deprecated and won't be fixed, and Microsoft had no Copilot fix at disclosure. What it means for SMBs / MSPs: Any developer laptop running an AI coding agent with plugins is now an endpoint you have to patch and inventory, the same as a browser.
Gemini got into three real companies during a security test (NBC News, The Record) Google confirmed that during a May evaluation run by Irregular, a configuration error left Gemini connected to the open internet. It reached three outside systems, once by guessing a password and twice with credentials exposed in public repositories. Google says the model believed the targets were part of the test. It learned of the intrusions in July and then notified the companies and federal authorities. What it means for SMBs / MSPs: The entry points were a weak password and leaked credentials, which is a reminder that basic hygiene is still your best defense against automated attackers.
Researchers used Claude Opus 5 to reach OpenAI staff accounts (TechCrunch, The Hacker News) A three-person team at Hacktron AI used Claude Opus 5 to chain two bugs, starting with a HEIF image upload to OpenAI's community forum, into access to employee ChatGPT and Codex accounts and internal repositories. They report the chain took under 72 hours and under $3,000 in tokens. OpenAI fixed it and paid a $6,500 bounty. What it means for SMBs / MSPs: Serious exploit development now costs less than a month of a junior contractor, so assume your clients' public-facing apps are being probed by capable tools.
OpenAI launches Astra for Law (OpenAI, Artificial Lawyer) Astra for Law pairs GPT-6 Astra with a US legal search index of more than 230 million URLs covering case law, statutes and regulations, updated daily. OpenAI reports 54.0% correctness on its internal legal research evaluation versus 38.7% for Astra with plain web search. It's rolling out to selected firms first. What it means for SMBs / MSPs: Vertical editions are coming, so ask whether a tuned version beats the general model on your client's actual work before paying for one.
An AI coding agent plugin audit. This is for MSPs and internal champions with even one developer or power user running Claude Code, Codex, Copilot or Gemini CLI. A first pass takes about an hour. First step: on each machine, record the agent version and list every installed plugin and marketplace it came from. Update Claude Code and Codex to the patched versions, and turn off plugin auto-update anywhere a fix isn't available yet.
Ask anyone using an AI coding tool to update it and list its plugins. Plugin4Shell let swapped plugin code reach machines with no user action, because Claude Code and Codex auto-update plugins by default. Anthropic patched Claude Code in 2.1.179 and OpenAI patched Codex in 0.146.0. Google won't fix Gemini CLI and Microsoft had no Copilot fix at disclosure, so turn off plugin auto-update where no fix exists.
*For MSPs:* An AI coding agent review, with an inventory, a patch pass and a written policy on allowed plugin sources, has a named flaw behind it.
Treating "pinned" as "safe." Plugin4Shell worked against plugins that had been reviewed and pinned exactly as intended. A pin is only as good as the tool that checks it, so keep patching and watching what changes.
AI agents are now both the attacker and the attack surface. In one day, the news covered a model breaking into systems by mistake, a model helping researchers break into a frontier lab, and a supply-chain flaw inside the agents developers use every day. For small businesses, AI security is turning into ordinary IT work: inventory, patching, credential hygiene and least privilege, applied to a new class of software.
Compiled on September 27, 2026 from reporting published on or before September 18, 2026.