Four coding agents shipped the same pinning bug, and two of them still have it

A research lab called AIR disclosed Plugin4Shell this week, a zero-click remote code execution flaw in the plugin systems of the four coding agents most likely to already be running inside your engineering org: Claude Code, Codex, GitHub Copilot, and Gemini CLI. The Register has the clearest writeup(opens in a new tab). The mechanism is small. The agent checks out the exact commit hash the marketplace pinned, then never verifies that the commit is what actually landed. An attacker who controls a plugin repository creates a branch named after that hash and makes it the default. Git resolves the branch before the commit, malicious code installs, and the pin still reads as honored. Plugins update in the background by default, so nobody has to click anything for it to happen.

Read the patch table as a procurement document rather than a security bulletin. Anthropic fixed Claude Code in version 2.1.179. OpenAI fixed Codex in 0.146.0. GitHub Copilot has shipped no fix. Google chose to deprecate Gemini CLI and move users to a different product instead of patching it. One bug, four vendors, four different answers. How a vendor behaves under coordinated disclosure is a renewal question, and this is a clean, checkable data point to raise by name at the next review.

The second report of the week runs the same trade in the other direction. Hacktron researchers used Claude Opus models to build a working exploit for a heap overflow in the libheif image library, chained it through the Discourse software running OpenAI's community forum, and took over several OpenAI employee ChatGPT and Codex accounts, again via The Register(opens in a new tab). One compromised Codex account was connected to OpenAI's internal GitHub organization. OpenAI patched in roughly 14 hours and paid a $6,500 bounty. The researchers' own summary is the line to carry into a board conversation: work that once required a well resourced team and months of effort now compresses into days.

Underneath both stories sits the credential layer, and it is in worse shape than either. Hush Security examined roughly 82,000 public MCP configuration files and found hardcoded credential literals in 12 percent of credential slots, reported by Help Net Security(opens in a new tab). Of the secrets it could classify, 53 percent carried organization, account, workspace, or database wide access, and 80 percent of those with a defined expiration policy did not expire by default. A plugin compromise is only as expensive as what the plugin can reach.

The cost question here is inventory, and it comes before controls. Most AI budgets over the last two years funded agent capability and quietly assumed the toolchain around it was somebody else's line item. Somebody still has to answer which agents run in your environment, which plugins they load, which versions those plugins are pinned to, and which long lived tokens sit in their configuration files. Vendors are already packaging that answer and selling it, which means it arrives as a budget request whether or not it was scoped this year. Naming an owner now is the cheaper path, because the inventory is the prerequisite for every control that follows and no purchase substitutes for having it.