Is there an AI coding assistant running on your machine or on your developers' machines? Then this is the most important check of the week. On 18 September, Plugin4Shell was made public: a zero-click vulnerability through which a malicious plugin update can execute code on the developer's machine, without anyone having to click on anything.
What exactly goes wrong
Air Security's research lab describes the problem in its technical explanation: coding agents pin plugins to a specific commit hash, but they then fail to verify that the fetched code really belongs to that hash. Whoever manages the repository behind a plugin, or takes it over, can point the checkout to other code while the pin still looks correct. Execution happens during the automatic background update, hence "zero-click".
So the problem is not the model itself, but the supply chain around it. Plugins run with the same rights as the developer who starts the agent: local source code, cloud credentials, SSH keys, internal repositories and production environments.
Who has patched and who hasn't
According to Help Net Security, the picture is mixed:
- Claude Code, fixed in version 2.1.179 (Anthropic confirmed the fix on 17 June)
- OpenAI Codex, fixed in version 0.146.0 (verified on 12 August)
- GitHub Copilot, no patch released
- Gemini CLI, no patch; Google discontinued the product on 4 August and refers to Antigravity
Air Security found the flaw in May and reported it in June to all four vendors. That the publication only comes now means that two of the four tools are still vulnerable months later.
In practice: check the version numbers of Claude Code and Codex, inventory which plugins are installed and whose repositories they come from, and switch off automatic plugin updates where possible. If you still use Gemini CLI, migrating is the only route. For employers this is also a GDPR matter: if source code or client data sits on a development machine, it falls under your security measures (Article 32). More context is available on our safety page and under AI for software development.
Alibaba releases CT model, with a major caveat
The same day, Alibaba's DAMO Academy published DAMO RADAR in Science and made the model available online as open source. It reads contrast-enhanced abdominal CT scans and detects 146 findings across 18 organs. On almost 40,000 real-world examinations it achieved an average AUC of 0.913 and outperformed 23 of the 26 radiologists in the comparison; with AI support, reading time fell by over 30%, reports South China Morning Post.
Impressive, but don't put it into your clinic tomorrow. This is research software, not a CE-marked medical device: for diagnostic use in the Netherlands the MDR applies, and under the EU AI Act this is high-risk. That open weights are available is relevant, though, you can run it within your own infrastructure, so imaging data never leaves the EU. See AI in healthcare and the model comparison.
