Signal criticality: High
What happened: The Hacker News published "Plugin4Shell Lets Repository Owners Swap Pinned Plugin Code Across Four AI Coding Agents". A flaw in four widely used AI coding agents lets someone who controls a plugin's code repository swap the plugin an agent installs for a malicious one, even when the agent locked that plugin to a specific reviewed version, security firm Air Security said on Thursday. The firm said Anthropic has patched the flaw in Claude Code 2.1.179 and OpenAI in Codex 0.146.0, that GitHub Copilot has no
Key takeaways:
Original source: https://thehackernews.com/2026/09/plugin4shell-lets-repository-owners.html
Signal criticality: High
What happened: Help Net Security reported that arcjet brings security controls and audit trails to AI agents Arcjet has launched agent runtime security, a new product that helps engineering teams secure the AI agents they are building while giving security teams the governance and compliance evidence they need. Arcjet brings observability, enforcement, and audit capabilities across agent workflows so teams can discover which agents are running, control what they can do, and understand what happened and why.
Key takeaways:
Original source: https://www.helpnetsecurity.com/2026/09/18/arcjet-agent-runtime-security/
Signal criticality: High
What happened: Unit 42 published that threat Research Center Threat Research Cloud Cybersecurity Research Cloud Cybersecurity Research A Vault with a Heap-View: The Uncomfortable Space Between AgentCore Harness and Identity 16 min read Related Products Cortex Cortex Cloud Unit 42 Cloud Security Assessment Unit 42 Incident Response By: Niv Rabin Published: September 18, 2026 Categories: Cloud Cybersecurity Research Threat Research Tags: Agentic AI AWS Cloud Exfiltration IAM Sandbox Shell tool Share Executive Summary Unit 42 researchers have identified an issue where using default configurations in Amazon Web Services (AWS) AgentCore Harness could allow attackers to steer an agent's actions through prompt injection to exfiltrate plaintext credentials managed by AgentCore Identity.
Key takeaways:
Original source: https://unit42.paloaltonetworks.com/securing-aws-agentcore-harness-credentials/
Signal criticality: High
What happened: Trail of Bits Blog published that why we couldn t have done this two years ago Security firms have published numerous blog posts describing how they pointed their agent harness at a codebase and found dozens of bugs ( we’re one of them ). These tools found real security issues, like an unvalidated prover-supplied input that would let a malicious prover forge Falcon signatures and steal funds from Miden account holders. Any issues found were added as regression tests to be fixed by the model.
Key takeaways:
Original source: https://blog.trailofbits.com/2026/09/18/auditing-in-the-age-of-good-enough-ai/
The strongest signal today is that AI security is being decided in the surrounding control layer — permissions, connectors, deterministic workflow design, response speed, and the infrastructure that still underpins trust. That is a more durable framing than generic agent hype, and it is the one worth carrying forward.