Executive Summary

Security researchers found a flaw that lets attackers run their own code through four of the most widely used AI coding assistants: Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI. No click is required from the user. Anthropic and OpenAI have released fixes. Microsoft has not. Google retired its product instead of repairing it.

Anyone whose developers use these tools should check versions this week. The same week also brought a funded push toward independent AI auditing, a new California oversight order, and a reminder of how much AI infrastructure debt sits outside public balance sheets.

Estimated reading time: 11 minutes

Key Takeaways

A flaw named Plugin4Shell breaks the safety check that was supposed to stop AI coding assistants installing tampered plugins. It gives an attacker the same access as the employee running the tool.
Claude Code and Codex are fixed. GitHub Copilot has no fix. Gemini CLI has been retired rather than repaired, so existing installs stay exposed.
AI auditing became a real business this week. Accenture will place its own evaluators inside Anthropic, with each company committing at least $1bn over five years.
California is moving toward mandatory onsite auditors and an emergency shut-off for the most advanced AI models. The US federal position is the opposite, which leaves companies planning against two different standards.
Anthropic’s revenue pace reportedly passed $100bn a year, mostly from businesses using AI for software development. That is a useful benchmark for how fast competitors are spending.
A second lawsuit against the AI music firm Suno asks whether buying licences later can clean up a model built on unlicensed material. The answer affects every generative tool a business buys.

What Happened?

Several unrelated stories landed in the same week, and together they describe an industry whose controls are being tested in public.

The security flaw

On 18 September, the security research firm AIR published details of a vulnerability it calls Plugin4Shell. It affects Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI.

All four tools let developers install plugins from a marketplace. To keep those plugins safe, each installation is locked to one reviewed version of the code. AIR found that none of the four tools properly confirms it actually loaded the version it locked onto. An attacker can swap in different code while the lock still appears intact.

The attack needs no action from the user. Claude Code and Codex update plugins in the background by default, so a tampered update reaches machines on its own.

AIR found the flaw in May 2026 and told all four vendors in June. Anthropic fixed it in Claude Code version 2.1.179. OpenAI fixed it in Codex version 0.146.0. Microsoft has shipped no fix for Copilot. Google retired Gemini CLI rather than patching it, and points users to a newer product called Antigravity.

Tool	Vendor	Status as of 18 September 2026
Claude Code	Anthropic	Fixed in version 2.1.179
OpenAI Codex	OpenAI	Fixed in version 0.146.0
GitHub Copilot	Microsoft	No fix released
Gemini CLI	Google	Retired, not fixed. Existing installs stay exposed

One detail limits the risk. The attack only works where a code repository allows a branch to be named like a version code. GitHub blocks this. Bitbucket and self-hosted servers generally allow it.

The push for independent auditing

On 12 September, Anthropic’s chief executive Dario Amodei published an essay arguing the industry should slow the rate at which AI capabilities improve. He was explicit that this means pacing progress rather than stopping it. The heads of OpenAI and xAI both endorsed the argument within hours.

Six days later, Anthropic named Accenture’s specialist AI unit, Faculty, as its first embedded evaluator. Both companies expect to invest at least $1bn each over five years. The arrangement gives outside reviewers access similar to an employee’s, so they can watch models being built and check whether safety commitments are being kept. Anthropic says the deal is not exclusive and that it is in talks with the non-profit evaluator METR.

Anthropic also published figures on how much of its own research AI now runs. It says Claude “leads” 26% of its AI research work as of August 2026, up from under 1% in February, with around 30,000 AI agents running at once on its main internal platform.

The regulatory split

On 18 September, California Governor Gavin Newsom signed an executive order speeding up the state’s AI oversight laws. It asks state agencies to produce recommendations within two months on four things: placing independent auditors inside AI labs, requiring safety filings to be verified by those auditors, creating an emergency shut-off for the most advanced models, and widening the definition of a reportable safety incident.

This builds on laws already signed. SB 53 (2025) requires developers of advanced models to publish safety frameworks and report serious incidents to the state. SB 813 and AB 1405, both signed in early September 2026, create a certification framework for independent verification firms and a state registry of AI auditors.

Over the weekend of 19–20 September, President Trump announced he would appoint an AI czar and create an “AI Force” modelled on the Space Force. He said the administration would not hinder the industry’s growth and described calls for a slowdown as a hoax. No structure, funding, legal basis or appointee has been published.

The money

A Financial Times investigation published on 20 September reported that technology companies issued up to $300bn of guarantees over the past year to support AI data centre and chip financing held in separate legal entities. The effect is that much of the risk does not appear as ordinary debt on the parent company’s books.

Two days earlier, the New York Times reported that Anthropic’s annual revenue pace had passed $100bn, up from around $65bn in July and roughly $9bn at the end of 2025. Its planned stock market listing has moved from October to November so third-quarter figures can be included.

The copyright case

On 18 September, Universal Music Group and Sony Music filed a second lawsuit against the AI music company Suno in a Massachusetts federal court. The complaint names 60,202 recordings and argues that Suno’s newest models are still infringing because they were partly built on output from earlier, unlicensed versions.

The week at a glance

Development	Who it affects most	Action required
Plugin4Shell flaw in AI coding assistants	Any business whose developers use these tools	Yes, this week
Independent AI auditing becomes funded work	Enterprise buyers, consultancies, audit firms	Monitor. Affects future procurement
California oversight order vs federal “AI Force”	Companies operating in the US	Plan against California
$300bn of AI infrastructure guarantees off balance sheets	Finance leaders, investors	Revisit cost assumptions
Anthropic’s revenue pace passes $100bn	Anyone benchmarking AI spend	Compare, no action needed
Second Suno copyright lawsuit	Marketing, content and legal teams	Review contracts

Why It Matters

Most weeks in AI produce announcements. This week produced consequences, and they land in different parts of a business.

The security flaw is the only item that demands action now. An AI coding assistant runs with the same access as the person using it. That usually means source code, cloud credentials, internal systems and sometimes production access. A compromised plugin does not steal a chat transcript. It runs commands.

What makes this different from a routine patch notice is that it broke the control organisations were relying on. The standard advice was to allow plugins only from a reviewed marketplace, locked to an approved version. That advice no longer holds on the unpatched tools.

Callout: The uncomfortable part

The victims here did everything correctly. They installed a reviewed plugin from a trusted marketplace, locked to an approved version. The lock is what failed. If your AI governance policy consists of “only use approved plugins,” this flaw went straight through it.

The auditing news matters commercially, not philosophically. Ignore the debate about whether AI is moving too fast. The practical development is that a large consulting firm has just been paid to inspect a frontier AI company from the inside. That creates a new professional services market, and it creates a document that enterprise buyers will eventually ask for during procurement.

The regulatory split creates planning work. California has signed laws, a registry of auditors, an incident reporting duty and a dated deliverable in November. The federal position is deliberately non-restrictive. That is not a relief for businesses. It means no new federal obligations, but also no national standard that overrides state rules. Companies operating across the US should plan against California and treat it as the likely floor.

The financing story affects your budget assumptions. AI has become steadily cheaper for two years. That price curve rests partly on infrastructure financed through arrangements where the risk is guaranteed but not booked as debt. Nothing improper is alleged, and everything is disclosed in company filings. But it means the cost base is less visible than it looks, and it has never been tested in a downturn.

The Suno case is about provenance, not music. Two questions are being decided. Does licensing content later fix a model that was built on unlicensed material? And does the existence of a licensing market weaken a “fair use” defence? Both determine whether the indemnity clause in your AI content contract is worth anything.

Business Impact

Software development teams

This is the group with a live problem. The immediate difficulty for most organisations is not patching. It is knowing what to patch. Very few companies can answer the question “which AI coding tools and plugins are installed across our machines?”

That inventory gap is the real finding. Developers adopt these tools individually, install plugins individually, and update automatically.

Security and IT leadership

Agent plugin marketplaces are new supply chains with none of the maturity of established software repositories. They run with user-level access by design, have no shared signing standard, and two of four major vendors have just demonstrated they may not patch at all.

Treat agent plugins the way you would treat unreviewed browser extensions on a finance workstation.

Finance and procurement

Two things to reconsider. First, budget assumptions: build one scenario where AI unit costs stop falling. Second, vendor stability: assess the financial resilience of AI suppliers and their cloud partners, not only the quality of their models.

The Anthropic revenue figures are also a useful benchmark. Spending is concentrated in software development and internal automation, not customer-facing chatbots. If your AI budget is flat year on year, you are probably an outlier.

Marketing, content and legal

Check what your generative AI contracts actually promise. Specifically, whether the vendor indemnifies you against copyright claims, and whether that protection survives a challenge to the model’s origins rather than just its training inputs.

Regulated industries

Healthcare deserves a separate note. The Financial Times reported on 20 September that clinicians are pushing back on AI being deployed beyond imaging and diagnostics, arguing there is limited peer-reviewed evidence for the wider uses. Deskilling, incorrect outputs and unclear governance were the main concerns raised.

Key Changes

The changes that materially affect businesses:

Plugin locking can no longer be assumed to work on AI coding assistants that have not been patched.
Background auto-update has become an attack path rather than only a convenience.
Two major vendors have no remedy available. Copilot users cannot patch. Gemini CLI users must migrate.
Independent AI evaluation is now funded work, with at least $2bn committed between two companies over five years.
California is moving from disclosure rules to verification rules. Publishing a safety framework may not be enough; it may need to be checked by a certified third party.
“Open weights” no longer reliably means “free to use commercially.” Alibaba released Qwen-Image-2.1 on 20 September under a research licence, while earlier models in the same family used a permissive commercial licence. Licences attach to individual model versions, not families.

Industry Reaction

Reaction to the security flaw has come mostly through vendor behaviour rather than statements. Two companies patched, one retired the affected product, and one has said nothing about a fix. AIR described it as the first supply chain vulnerability of the AI agent ecosystem.

On the slowdown argument, reaction was faster and more divided. OpenAI’s Sam Altman agreed publicly and said his company would also give access to outside evaluators. Elon Musk endorsed it in three words. Critics argued the essay was partly about market position, and Axios noted that self-restraint is hard to sustain when companies cannot be sure competitors will follow.

There is also a sceptical thread worth keeping in view. The New York Post reported claims from unnamed insiders that the major AI labs have overstated security incidents to influence regulators. That claim is unverified and comes from a single low-reliability source, but it reflects a genuine strand of the current debate. TechCrunch separately argued that the public conversation is now mixing documented incidents with speculation in ways that are hard to untangle.

On Anthropic’s research automation figures, commentators noted a straightforward limitation: the ratings were largely produced by Anthropic’s own model, and no outside party has checked them.

Suno called the labels’ claims flawed on both the facts and the law.

Opportunities

Negotiating leverage on AI contracts. Vendors are competing hard for committed enterprise revenue. This is a reasonable moment to ask for price protection, exit terms and clearer indemnities on multi-year agreements.

Lower-cost model options are arriving quickly. Several releases this month improved the price-to-capability ratio noticeably, including new models from StepFun and Alibaba at a fraction of the cost of the leading Western models. Anyone still running on 2025 pricing should re-tender.

Local and on-premise deployment is becoming realistic. PrismML released a compressed version of a 27-billion-parameter model that runs on a 16GB laptop while keeping most of its benchmark performance. For organisations that cannot send data to an external service, that changes what is possible.

AI governance as a commercial advantage. Being able to show a customer that you know which AI tools your staff use, and how they are controlled, is becoming a differentiator in enterprise sales.

Services opportunity. For consultancies and IT providers, “AI agent supply-chain audit” is now a service with a clear trigger event behind it.

Future Signal Tip

Before you buy any AI governance tooling, spend one afternoon producing a simple list: which AI tools are installed, on which machines, by whom, with which plugins, and updating how. Most organisations discover the answer is far broader than expected. That list is worth more than most products you could buy this quarter.

Risks & Limitations

Several things in this week’s news are less certain than headlines suggest.

On the security flaw: no CVE identifier, severity score or official vendor advisory was found during research. The detail comes from AIR’s own disclosure and reporting on it. Microsoft’s status may have changed since 18 September, so verify before acting on it.

On the slowdown: nothing announced changes a product roadmap, an interface or a price today. The essay contains one firm commitment and two proposals. The alarming forecast within it, concerning what AI agents might be capable of within six to twelve months, is a stated worry about a hypothetical future system, not a description of any model available now.

On California: the four items above are recommendations to be developed, not law. Scope and timing may change.

On the federal “AI Force”: there is nothing to comply with. No structure, mandate, funding or legal basis has been published.

On the financing story: the original Financial Times article is behind a paywall, so the figures here come from secondary coverage. Every structure described is permitted under current accounting rules and disclosed in company filings. No wrongdoing is alleged, and no default or credit event has occurred.

On Anthropic’s revenue: “annualised run rate” is a pace measure taken from a short period. It is not revenue collected and it is not profit. The $100bn figure comes from New York Times reporting citing anonymous sources. Anthropic has not published it, and the $2tn valuation is a figure under discussion rather than a priced deal.

On the Suno case: the new filing is a second lawsuit, not a second ruling. The headline damages ceiling of roughly $9bn is a theoretical statutory maximum, not an expected award.

Future Outlook

Over the next 6 to 24 months, three developments look likely.

Agent marketplaces will get signing requirements. This is editorial interpretation rather than announced fact, but the direction is clear. Software repositories went through the same process. Expect signed plugins, attestation and agent inventory features to appear in enterprise security tools, and expect agent usage to appear on audit checklists.

AI auditing will formalise into a small number of accredited firms. Anthropic has said further evaluator announcements are coming within weeks. California is already building a registry of certified auditors. The voluntary version and the mandatory version are converging on the same structure, which is unusual and probably not accidental.

Compliance will stay fragmented through 2027. California’s recommendations arrive around November 2026, feeding a 2027 legislative session. A comprehensive federal law looks unlikely in the near term; narrow incident-reporting legislation is more plausible. Businesses operating across multiple US states should plan for a patchwork rather than waiting for a single standard.

One thing to watch specifically: if Anthropic lists publicly in November, its filings would be the most detailed picture the industry has produced of what AI actually costs to deliver. That single document would tell buyers more about future pricing than a year of product announcements.

The Future Signal

The pattern worth noticing this week is that AI’s supporting systems all came under strain at once, and none of them broke for a dramatic reason.

The security flaw worked because a routine software check was slightly wrong. The financing story exists because ordinary accounting rules were applied to an extraordinary building programme. The auditing push happened because the companies building these systems concluded they cannot fully verify their own work. None of this is science fiction. It is ordinary organisational failure arriving at unusual speed.

For business leaders the practical lesson is about pace of adoption versus pace of control. Most companies have adopted AI tools faster than they have built any ability to see what those tools are doing. That gap is where the risk sits, and it is entirely fixable with unglamorous work: an inventory, a patching process, a contract review, a named owner.

The companies that will handle the next two years well are not the ones with the most advanced models. They are the ones that can answer basic questions about their own AI use within an hour. Very few can today. That is a cheap advantage still available to almost anyone willing to do the boring part.

What Businesses Should Do Next

Recommendations are listed in order of urgency.

This week

Checklist: AI coding agent exposure

Identify every machine running Claude Code, OpenAI Codex, GitHub Copilot or Gemini CLI, including personal and contractor devices.
Confirm Claude Code is on version 2.1.179 or later.
Confirm Codex is on version 0.146.0 or later.
For GitHub Copilot, check whether Microsoft has released a fix since 18 September. If not, restrict plugin use and review what system access those machines hold.
For Gemini CLI, plan migration. No fix is coming.
List which plugins are installed and where they are hosted. Repositories that allow branches named like version codes carry higher risk.
Review what credentials and systems a developer machine can reach, and reduce that where it is wider than necessary.

This month

Review your generative AI contracts for copyright indemnity, and check whether it covers claims about how the model itself was built.
Check the licence on any open-weight model you run. Licences change between versions of the same model family.
Re-tender your AI spend if pricing was agreed more than six months ago. Cheaper capable options have arrived.

This quarter

Write a short AI tool policy covering approved tools, plugin rules, update handling and who owns the decision. One page is enough to start.
Plan compliance against the California framework if you operate in the US, and against the EU AI Act separately if you operate in Europe.
Add a cost-plateau scenario to your AI budget planning for 2027.

Monitor rather than act

The California recommendations due around November 2026.
Any detail on the federal “AI Force”. At present there is nothing to respond to.
The Suno rulings, if you rely on AI-generated content commercially.

Frequently Asked Questions

We use GitHub Copilot and there is no fix. What should we do? Reduce exposure rather than waiting. Limit or remove marketplace plugins, check whether your repository host allows branches named like version codes, and tighten what systems and credentials developer machines can reach. Check for a vendor advisory before assuming the status is unchanged.

Does this affect the chat version of these AI tools, or only the coding assistants? The flaw concerns plugin installation in command-line coding agents. A standard chat interface without plugin installation is not affected by this specific issue. That said, any AI tool that can execute actions on your systems deserves the same review.

Should we stop using AI coding assistants? No. The productivity case has not changed, and two of the four vendors patched within the disclosure window. The lesson is that these tools need managing like any other software with system access, rather than being adopted informally by individual developers.

Does the call to slow down AI mean fewer new features next year? Nothing announced changes any product roadmap, interface or price today. Treat it as a signal about where governance is heading rather than a reason to change your plans.

If a US federal AI agency is coming, should we wait before acting on state rules? No. Nothing has been published about the proposed federal body, and the stated position is not to restrict the industry. California’s rules are already law and carry real reporting duties.

Is AI about to get more expensive? There is no evidence of a price rise. The point is narrower: the infrastructure behind current pricing is financed in ways that make the true cost base harder to see, and that structure has not been tested in a downturn. Plan for one scenario where prices stop falling.

We use AI-generated images and audio in marketing. Are we at risk? The direct risk sits with the AI vendor, not usually the customer. The practical step is to confirm your contract includes copyright indemnity and to understand what it excludes. The Suno case is testing whether a model built on unlicensed material stays exposed even after its owner buys licences.

What single thing should we do if we only have an hour? Build the inventory. List which AI tools are installed across your organisation, on which machines, with which plugins. Almost every practical decision in this article depends on having that list.

Conclusion

The most important item this week is also the least dramatic. A flaw in how four AI coding assistants verify plugins gives attackers the access of the developer running the tool, and two of those four have no fix available. If your engineers use these tools, checking versions and plugin inventories is this week’s work.

Everything else is a planning matter rather than an emergency. Independent AI auditing is becoming a funded industry, and evaluator reports will eventually appear in procurement. California is moving from disclosure to verification while Washington moves the other way, so plan against the stricter standard. Enterprise AI spending is compounding faster than most 2026 budgets assumed, concentrated in software development rather than customer-facing tools.

The common thread is that AI adoption has outrun AI visibility in most organisations. Closing that gap does not require new technology or a large budget. It requires knowing what you are running, keeping it current, and deciding who owns that responsibility. That is unglamorous work, and it is the best return available on an hour of management attention this quarter.

AI Coding Agents Hit by a Zero-Click Security Flaw: What Businesses Need to Check This Week