Why Coding Agents Got Hacked This Week
Plugin4Shell hit four coding agents and Codex fixed two sandbox escapes on Sep 20. How the attacks work in simple terms, plus five checks before you install.
On this page
Your agent installs a reviewed plugin, then the plugin changes under it. That is the simple story behind a rough week: Plugin4Shell disclosed September 17 across four coding agents, plus two Codex sandbox escapes fixed September 20. Here is how each attack works without jargon, and five checks anyone can run.
Takeaways
Plugin4Shell breaks the promise of pinned versions: the agent checks a commit hash but never confirms it landed there.
Heapjack breaks the promise of read only mode: shared memory leaks the token that marks code as trusted.
Overpatch breaks the promise of folder limits: naming /tmp widens write access to the disk root.
Fix order: update, turn off auto update, limit plugin sources, review diffs, keep spend gates on.
How does a pinned plugin still swap code?
Think of a pin as a luggage tag that says "load case 8F3A". The handler reads the tag but never opens the case to check. Plugin4Shell prints a branch name that looks like a commit hash, Git resolves the request to the attacker branch, and the agent loads new code while the tag still reads as reviewed. With background auto update on, the swap lands silently. Air built working proofs against all four agents in May and notified vendors in June. Anthropic patched in 2.1.179, OpenAI in 0.146.0.
promise: marketplace reviews code -> pins hash -> agent installs exact hash
reality: agent asks for hash -> git accepts branch with same name -> malicious code loads
trigger: auto update on -> no click, no prompt, trusted plugin becomes untrustedWho is affected right now
Claude Code fixed, Codex fixed, Copilot no patch with risk on non GitHub hosts, Gemini CLI retired with no patch. If you run Copilot or Gemini CLI, treat every third party plugin as unreviewed until you move.
What do the Codex escapes teach in plain words?
Heapjack: secret in shared room
Desktop runs trusted and untrusted code in one Node process with two contexts. The token lives in shared heap, untrusted code snapshots memory, finds UUID shaped strings, and reuses the token to ask the unsandboxed parent for help.
Overpatch: permission math bug
apply_patch grants parent folder access per path in a patch. Include /tmp plus a symlink to home, and the tool approves a write to .zshrc that runs on your next terminal.
Same root cause
Enforcement lived inside the thing it policed: permissions derived from attacker input, secrets stored beside attacker code. Pillar showed the same shape across Cursor and Gemini CLI in July.
Fix and credit
Reported August 12 by Oren Yomtov at Accomplish AI, fixed in eight days. Update Desktop past 26.818.21641 and CLI past 0.149.0, then restart agents to pick up the new binaries.
What are the five checks before you install?
Check version first, then plugin list, then auto update setting, then source host, then recent diff. Prefer GitHub hosted plugins where hash shaped branch names face platform rules, avoid Bitbucket or self hosted sources for Copilot until a patch ships. Pin to a version you tested, read the diff on update, and keep destructive tools behind approval so a swapped plugin cannot push, delete, or charge without you.
Should beginners panic?
I only use one agent for small tasks: am I at risk?
Risk scales with plugin count and auto update. Zero third party plugins plus auto update off means near zero exposure to Plugin4Shell. The Codex escapes needed untrusted repos or patches, so avoid opening unknown repos in older builds.
What about GitSpawn from early September?
Same lesson at the Git layer: a repo config like core.fsmonitor can run commands during background Git ops across seven agents, tracked as CVE-2026-19592 and CVE-2026-72718 among others. Open repos in a sandbox, keep agents updated, and treat repo configs as code.
As of September 23, 2026: supply chain trust moved from version numbers to verification. Update today, disable silent updates, and approve side effects out loud. Next, read one person many agents for how to run fleets without multiplying this risk.