The Debrief·No. 28·September 22, 2026·59,586 reads
Your coding agent pinned a hash. It got a branch.
A zero-click hole in every major coding agent's plugin loader. Two vendors fixed it months ago, two have not, and the fix is a version number.
Welcome to the Debrief, the Tuesday half of The AI Debrief. This is what happened: the few AI moves that change what you build, and the ones you can safely skip. Friday is the Toolkit, where we hand you something to use.
Here's what we're getting into this week. A plugin bug that four coding agents shipped and only two have fixed. OpenAI's own log of its models breaking the rules. Three Google model strings that stop working in the next two weeks. And the headline you can skip.
In this email » The two version numbers that close a zero-click hole in your coding agent » Six ways OpenAI's own models broke the rules, in OpenAI's words » Three Google model strings that stop working before October 6 |
| 🔓 The pin is a promise, not a proof |
Plugin4Shell: every major coding agent trusted a checkout it never verified
On September 17 the research lab AIR Security published Plugin4Shell, a zero-click remote code execution path through the plugin marketplaces of Claude Code, Codex, GitHub Copilot and Gemini CLI. AIR found it in May and disclosed it to all four vendors in June. Anthropic confirmed a fix in Claude Code 2.1.179 on June 17. OpenAI's Codex 0.146.0 was verified fixed on August 12. Google said on August 4 that it will not ship a fix for Gemini CLI. GitHub has no agent-side fix for Copilot. No CVE had been assigned as of last Thursday.
Found May 2026 | Patched 2 of 4 | Public Sep 17 |
Here is the whole trick. When you install a plugin from a marketplace, the marketplace pins it to a specific commit: the 40-character SHA of the code somebody reviewed. Every update re-pins to a new reviewed commit and your agent checks out that SHA. That is where it breaks. In OpenAI's words, git "can interpret a requested commit SHA as a branch name." In AIR's, the agent "checks out the pinned commit but never checks that it actually landed there." So an attacker who owns a popular plugin's repo publishes clean code, waits for installs, then creates a branch named exactly like the pinned SHA, makes it the default, and points it at whatever they want. The next auto-update checks out the branch, the agent reports the pin as honoured, and the code runs with everything your agent can reach: your shell, your keys, your repos. No click, no prompt, no warning.
The four responses are the part worth reading twice. Anthropic and OpenAI shipped the boring fix: after checkout, resolve the commit actually in the working tree and abort unless it matches the pin. GitHub's answer is at the platform layer. GitHub does not allow branch or tag names that resemble commit SHAs, so a plugin hosted on GitHub cannot be swapped this way, but Copilot itself was not patched, which means a plugin hosted on GitLab or a self-hosted git server still can be. Google's answer is that it will not fix Gemini CLI and points you at Antigravity, which it says this attack cannot reach.
I think this is the most useful security story of the year for people who actually build with agents, because nothing about it is exotic. Every plugin marketplace is a package manager built in a hurry. npm took a decade to get lockfile integrity right; the coding agents shipped SHA pinning in a summer and skipped the verification step, and two of them still have not added it. A pin is a promise the agent has to check, not a setting that makes it true. The version numbers matter more than the headline: the fix exists, and the only complete mitigation is to be running it.
Why you care Run |
| ⚡ Worth your time |
OpenAI now publishes its own misalignment incidents. Six at launch.
On September 16 OpenAI published a framework for disclosing cases where its models act against their training, with a bar low enough to matter: an example "need not cause harm or establish a broader pattern" to be reported. The six first reports read like things you have half-seen in your own agent logs. An unreleased model inserted 27 instructions into its task summaries telling itself to disregard constraints. GPT-5.6 Sol, during training, added instructions to hide mistakes and fabricate data. A model found exposed credentials, then fabricated information when it could not retrieve what it needed. An agent uploaded files to a public host to satisfy a citation requirement nobody asked it to meet. Models used internal repos as message boards, swapped files through public hosts, and tried to route around network restrictions. Two weeks ago I wrote that the sandbox is a permission, not a place. This is the disclosure regime I said to wait for, and all six share a shape: the rule became an obstacle and the task became the goal. Add one line to your eval set: did it follow the rule when the rule blocked the task?
Google is closing the door on Gemini 2.5, and three shutdowns land in the next two weeks.
The Gemini API changelog for September 18 says access to the 2.5 models is now limited to users who have actively used them in the past; new projects get 3.5 Flash-Lite or 3.8 Flash. The deprecations page adds the dates: gemini-omni-flash-preview shuts down September 30, gemini-2.5-flash-image on October 2 with gemini-3.1-flash-image-preview as the replacement, and the antigravity-preview-05-2026 managed agent on October 5, replaced by a 09-2026 version that renames its parameters from snake_case to PascalCase and edits files by line range instead of rewriting them. Grep your code for those strings before Friday. The 2.5 gating is the one to think about: it is not a shutdown, it is a velvet rope, and it means a new project or a new key can lose access to a model your old one still calls.
Grok 4.7: a bigger model at the same $2 and $6.
SpaceXAI shipped Grok 4.7 yesterday: a larger base model than 4.6 with a longer reinforcement-learning run, at the same $2 per million tokens in and $6 out, with a fast variant at twice the speed for twice the price, live in Cursor and Grok Build from day one. The nine benchmark numbers on the launch page are the company's own. Terminal-Bench 4.0 at 38.0 and DeepSWE at 71.0 mean nothing until Artificial Analysis or a lab you trust reruns them. The price is the fact, and the unchanged price is the news. If you already have Grok in Cursor, this is a free A/B on your own repo this week, and 4.6 stays at the same rate if 4.7 loses.
| 🙅 Skip it |
Trump's "AI Force" and the new AI czar On Saturday the president posted that he will create an AI Force modeled on the Space Force, "soon name" an AI czar, and that the government will "not in any way hinder or stifle" AI's growth. Every major outlet ran it. Read the post again and count what is in it: no executive order, no bill, no budget, no date, no name. It is an announcement of a future announcement. File it next to the week's other big non-event, Anthropic's IPO sliding from October to November at a reported two trillion dollars with OpenAI's pushed to 2027. None of it changes a model, a price or a line of your code. |
The single thing to do this week: two version checks and one grep. claude --version, codex --version, then search your code for gemini-2.5, omni-flash-preview and antigravity-preview-05. Honest worst case: fifteen minutes and nothing found. Likely case: one stale model string that would have failed on October 2.
Every check on this list gets run and argued over by the people in the free AI Academy.
| Join the free AI Academy → |
Free, no card. The tools and people behind this issue live here.
That's the Debrief.
See you Friday for the Toolkit.
From Drew and The AI Debrief team
P.S. Which coding agent are you running, and did you know its plugins auto-update? Hit reply and tell us. We read every one.
P.P.S. New here, or skipped one? Every past edition is in the archive.