AI agents just had their npm moment

For two years the worry about AI agents has been the model. Will it lie? Will it be jailbroken? Will it go rogue? Last week the industry got an answer, and it was embarrassingly mundane. Nobody had to trick the model. They just had to poison the app store.

The flaw was in the store, not the robot

On Thursday 17 September, Air Security disclosed a vulnerability it calls Plugin4Shell: a zero-click remote code execution flaw affecting five of the most widely used AI coding agents on the planet. Anthropic's Claude Code. OpenAI's Codex. Google's Gemini CLI. Microsoft Copilot. GitHub Copilot.

Here is the part worth slowing down for. The attack does not target the model at all. It targets the trusted marketplaces that host plugins for those agents.

The mechanism is a SHA-pinning bypass. Pinning is meant to be the seatbelt of software distribution. Instead of saying "give me the latest version of this plugin," your tool says "give me exactly this commit, this exact fingerprint, nothing else." Air found that the agents check out the commit the marketplace pinned, but never verify that the commit actually landed there. An attacker who controls the plugin's repository can make that checkout resolve to malicious code while the pin still looks perfectly honoured.

Picture a hotel that checks your keycard against the number printed on the card rather than against the lock. The card says 412. The front desk says "great, room 412." Nobody ever checked which door it actually opens.

Zero-click is the word that matters

Plugins auto-update. Claude Code and Codex both auto-update installed plugins by default, which is exactly the convenience that turns a supply-chain flaw into a zero-click one. You do not click a bad link. You do not install anything new. You open your editor in the morning and the compromise arrives on schedule, like the paper.

And plugins inherit whatever the developer running the agent can reach: local source code, cloud credentials, SSH keys, internal repositories, production systems, secrets. Microsoft's own figure is that almost 90% of Fortune 500 companies use Copilot.

This is not a model jailbreak. It is npm-style dependency risk arriving in a layer most teams still treat as an editor feature.

The patch table is the real story

From The Register's reporting on the disclosure:

• Anthropic, Claude Code: patched in 2.1.179
• OpenAI, Codex: patched in 0.146.0
• Google, Gemini CLI: will not patch. Deprecated, users told to migrate to Antigravity CLI
• Microsoft Copilot: not fixed. Air reported in June and got no response
• GitHub Copilot: GitHub says its SHA-name restriction blocks the attack. Air disputes this, because marketplaces can be hosted on Bitbucket and elsewhere

Two facts in that list deserve to outlive the news cycle. The first: deprecating a product is now an accepted answer to a disclosed remote code execution flaw. That is a procurement fact about the whole category. Agent tooling currently has a shorter support life than the projects built on top of it.

The second: Air reported to every vendor in June. Three months later, two of them still have no fix, and one of those never replied at all.

Meanwhile, in Spain

On 14 September, Spain's data protection authority, the AEPD, received what it says is the first formal GDPR breach notification involving an autonomous AI agent. Deputy Director Francisco Pérez Bes published the disclosure on the agency blog the following day.

The reported sequence reads like a penetration test that nobody commissioned. The agent searched generic files for vulnerabilities, achieved an unauthorised login, autonomously probed the application for further weaknesses, modified personal data, and accessed invoices. Human steering throughout was limited. The agent was built on a known large language model, but the AEPD has not named the organisation, the model, or the sector.

The regulator's framing is the genuinely useful part, and it is refreshingly unhysterical: Article 33's 72-hour notification clock applies whether the attacker is a human or an autonomous system. AI does not invent new categories of threat so much as it compresses the time you have to detect and contain the familiar ones.

Notice how neatly the two stories interlock. Plugin4Shell is an agent inheriting a developer's credentials. The Spanish filing is an agent using a credential it found lying around. Same underlying problem, approached from opposite ends.

The fix is arriving from the platform layer

In the same window, Google updated its Gemini API managed agents with new Files and Credentials APIs. The Credentials API lets an agent call a service like GitHub or Slack without ever exposing the token to the model. Microsoft's Agent Framework 1.19.0 for Python scoped MCP sessions per invocation, authenticated requests to the correct identity and origin, restricted skill archives to ZIP, and added archive digest verification.

These are the right responses, and it is worth noticing where they came from. Not from the frameworks, not from best-practice blog posts, but from the platforms themselves. "The model never sees the token" is a security property you can defend in a questionnaire. A session that dies with the call cannot be replayed. Both are old ideas, correctly applied to a new layer.

What to take from this if you do not write code

Three things travel well beyond the developer world.

1. Every plugin, skill and connector you install into an AI tool is a dependency with an update channel. Somebody in your organisation should be able to produce the list. Most cannot.
2. Auto-update is a security decision, not a convenience setting. It was the difference between a bug and a zero-click bug here.
3. The credential an agent holds is the blast radius of everything that goes wrong with it. Smallest possible scope is the whole game.

The agent era did not arrive with a rogue superintelligence. It arrived with an unverified commit hash and a token that had more permissions than the job required. In a strange way that is reassuring. These are problems the industry already knows how to solve. It just has to admit they apply here too.