Week 38 · September 14 to September 20, 2026
AI security this week
In week 38 of 2026 (September 14 to September 20, 2026), The Injection tracked 3 AI security stories, 1 of them rated high or critical, including "Plugin4Shell: zero-click plugin RCE in four AI coding agents" and "Explosive prompts: dormant injections fire on 'thanks' in agents". Most affected: Claude Code (2), Gemini CLI (2) and GitHub Copilot (2).
.png)
Top storyHIGH
Plugin4Shell: zero-click plugin RCE in four AI coding agentsA git branch named after a commit hash lets an attacker swap a pinned, reviewed plugin for malicious code during auto-update.
What to do · Update Claude Code to 2.1.179 or later and Codex to 0.146.0 or later. Audit plugins installed in Copilot, and move off Gemini CLI, which Google advises replacing with Antigravity.
High 1
HIGH
Vulnerability · AIR Security
Plugin4Shell: zero-click plugin RCE in four AI coding agentsPlugin4Shell is a zero-click remote code execution flaw in how Claude Code, Codex, GitHub Copilot and Gemini CLI install pinned plugins. AIR says Claude Code and Codex are fixed, Copilot is not, and Gemini CLI will not be patched.
Medium 1
MED
Research · arXiv
Explosive prompts: dormant injections fire on 'thanks' in agentsExplosive prompts are dormant prompt injections that wait for a harmless trigger such as 'thanks'. A new paper reports 43% to 83% success on nine production agents, versus at most 3% for plain injections, and proposes the DeFuse detector.
Info 1
INFO
Benchmark · NIST CAISI
CAISI: GLM-5.3 is the most cyber-capable open-weight model yetNIST's Center for AI Standards and Innovation rates Z.ai's GLM-5.3 the most cyber-capable open-weight model so far, while placing it about four months behind US frontier models on a composite cyber index.