THE 60-SECOND VERSION
● Update Claude Code to 2.1.179 and Codex to 0.146.0. Copilot has no fix and Gemini CLI was deprecated instead.
● OpenAI's ad pixel is documented, and collects less than the headlines say.
● California ordered onsite frontier lab audits within two months.
One bug, four agents, two fixes
Researchers at AIR found that Claude Code, Codex, GitHub Copilot and Gemini CLI all pin plugins to a reviewed commit hash and all four check that commit out without verifying the checkout landed there. On platforms permitting a branch named after a commit hash, an attacker swaps the code and the pin still looks valid. No user interaction required.
Anthropic fixed it in Claude Code 2.1.179 and OpenAI in Codex 0.146.0. Microsoft has not shipped a fix for Copilot. Google deprecated Gemini CLI rather than patching it, which moves the work to the user without telling them there is work to do.
Why four rival teams made the identical mistake →
The ad pixel is real, and documented
OpenAI publishes the spec for its ChatGPT ads measurement pixel: conversion events, optionally hashed email, phone and name, location down to postal code, page URLs, and a randomly generated __obref cookie lasting 365 days.
Reports that it binds browsing to a logged-in ChatGPT account via a JWT cookie are reverse-engineered rather than documented. We are reporting what the specification says and flagging the rest as unconfirmed.
The full field list, and why hashed is not anonymous →
Also this week
- California signed an AI oversight order requiring kill-switch recommendations and onsite audits of frontier labs within two months. That is the first concrete mechanism in a month of voluntary frameworks. Regulation was the option nobody wanted →
- Anthropic and Accenture named Accenture's Faculty unit as Anthropic's first embedded evaluator for red-teaming, with more than $1B committed by each side over five years. Whether an outside body can publish is still the test →
- Alibaba released Qwen-Image-2.1, a 7B model with native 2048x2048 output — and moved it from Apache 2.0 to a research-only licence. What you give up when the terms change →
- Universal and Sony sued Suno over 60,202 recordings, alleging the v6 models trained on infringing outputs from earlier versions. Licensing is now the difference →
- StepFun opened API access to Step 5 Preview, a 600B sparse MoE with a 1M-token context, at $1 per million input and $2.70 per million output.
- OpenAI and Anthropic are both expanding in Singapore, with Anthropic opening an office in October.
The rest of the month
| Date | What happens |
|---|
| Sept 29 | OpenAI DevDay, San Francisco |
| Oct 1 | OpenAI vs Apple hearing |
| Oct 24 | deepseek-chat and deepseek-reasoner deprecated |
| By late Nov | California onsite frontier lab audits due |
| November | Anthropic IPO target. Timing may move |
| Nov 12 | OpenAI models leave Cursor |
Sources
FAQ
Which coding agents are affected by Plugin4Shell?
Claude Code, Codex, GitHub Copilot and Gemini CLI. Claude Code is fixed in 2.1.179 and Codex in 0.146.0; Copilot has no fix and Gemini CLI was deprecated rather than patched.
Do I need to do anything today?
Update Claude Code and Codex, and remove Gemini CLI if it is installed. Then check which plugins your agent loads and where they are hosted.
Does OpenAI track me across the web?
Its measurement pixel runs on sites that install it and records conversion events with hashed identifiers and a first-party cookie. Stronger claims about account-level linking are circulating but are not in the published documentation.
What did California order?
Kill-switch recommendations and onsite audits of frontier AI labs within two months.