Four disclosures in the past week, and in each one a control that teams assume is doing its job turns out not to be. A pinned plugin version that does not actually pin. An AI gateway that ships with its management authentication switched off. An approval prompt where the action a person reviewed is not the action that runs. And a European regulator logging a breach in which an agent, working from valid credentials, found the weakness and acted on it without anyone directing the intermediate steps. None of this is about models becoming cleverer. It is about the scaffolding around them being trusted more than it has earned.
1
A flaw named Plugin4Shell lets a plugin update run attacker-controlled code inside four widely used AI coding agents, and the version pin that was supposed to prevent this does not hold
The Air Security research lab published the finding on 17 September 2026, credited to Or Nevo, Dor Granat and Niv Hoffman. It concerns the plugin and extension mechanism in Claude Code, OpenAI Codex, GitHub Copilot and Google Gemini CLI. Developers pin a plugin to a reviewed commit identifier on the understanding that the code cannot then change underneath them. The researchers showed that the agents check out the pinned identifier but never confirm afterwards that the working tree actually landed on it, and that a repository reference whose name is a forty-character hexadecimal string can take precedence over the commit object of the same name. The pin reports success while different content is installed. It requires no click because Claude Code and Codex update installed plugins in the background by default, so the sequence is to publish something useful, wait for adoption, and change the upstream repository later. No CVE identifier was recorded at publication. Patch status as reported by the researchers: Anthropic fixed it in Claude Code 2.1.179 and OpenAI in Codex 0.146.0. Microsoft has not shipped a fix for GitHub Copilot. Google is not planning one for Gemini CLI, which it has deprecated in favour of Antigravity.
Why it matters for IndiaCoding agents are now standard issue in Indian product companies, GCC engineering functions and services firms working on client estates, and a plugin inherits whatever the developer running the agent holds. On a typical Indian engineering workstation that means source code, cloud credentials, SSH keys, CI tokens and, for services teams, access into a customer's environment rather than only your own. The research does not report exploitation, and no source describes Indian organisations being targeted. The exposure is structural: the reason teams allowed plugins at all was that pinning made the supply chain reviewable, and for two of these products that assurance is still not restored.
ActionUpgrade Claude Code to 2.1.179 and Codex to 0.146.0. For Copilot and Gemini CLI, where no fix is available, take the decision consciously rather than by default: disable automatic plugin updates, or restrict plugins to an internal allowlist, and record who accepted the risk. Find out whether your engineering teams have plugins installed at all, because in most organisations nobody is tracking this. Run coding agents without production credentials in the environment, and rotate anything an agent workstation has held.
SourceAir Security research lab, "Plugin4Shell" (17 September 2026); The Register (17 September 2026); Help Net Security (18 September 2026).
2
A critical flaw in the Bifrost AI gateway allows command execution with no credentials at all, and the authentication that would have stopped it is off by default
JFrog Security Research published CVE-2026-90898 on 14 September 2026, found by Yuval Moravchick, with wider reporting on 22 September. It is rated 9.8 and affects the Bifrost HTTP transport, maintained by Maxim, in all versions before 2.1.0. A single unauthenticated request to the management API can register a stdio-type client, at which point the gateway launches the specified command as its own process user, before any handshake takes place. The condition that makes this reachable is the shipped default, in which management authentication is disabled and every caller is treated as a local administrator. The stock binary binds the management API to localhost, which limits exposure, but the official Docker image binds to all interfaces, so the management API is reachable from outside the container wherever the port has been published. Check your version carefully: the 2.0.0 release fixed an earlier plugin issue, CVE-2026-86242, and does not block this one, and the 1.6.x line through 1.6.11 has neither fix. A separate batch of roughly twenty CVE identifiers was published on 22 September 2026 against sooperset/mcp-atlassian, the Model Context Protocol server that connects agents to Jira and Confluence, including CVE-2026-77254 at 9.1 for missing authentication on the HTTP endpoint and CVE-2026-77255 at 8.6, where the server can be made to read local files and attach them to an issue. The chronology is worth stating plainly, because it cuts both ways: the fix has been available in 0.22.0 since the upstream advisories of 10 July 2026, so this is a CVE assignment catching up rather than a new disclosure. Anyone who has not upgraded has been exposed for over two months.
Why it matters for IndiaAn LLM gateway is the one component that holds provider keys for every model an organisation uses, which is precisely why Indian banks, fintechs, telecom operators and GCC platform teams put one in front of their AI estate. Command execution on that process is access to the whole key set and to the traffic passing through it. The default-off authentication is the part to dwell on, because a team standing a gateway up for an internal pilot has no prompt telling them the control exists, and pilots in Indian organisations routinely reach production without anyone revisiting that. For a regulated entity, prompt and response traffic through that gateway is customer data under the Digital Personal Data Protection Act.
ActionUpgrade Bifrost to transports 2.1.0 or later, and do not treat 2.0.0 as sufficient. Upgrade mcp-atlassian to 0.22.0. Enable management authentication on every gateway you run and confirm the management listener is not published outside the host, checking that from another machine rather than from the configuration file. Where an instance ran with authentication disabled and the management API reachable, follow JFrog's guidance and treat it as compromised: rotate virtual keys and every provider credential it held. Then apply the general form of this to the rest of the estate, because agent and gateway control planes are the surface where authentication is most often available and least often switched on.
SourceJFrog Security Research, CVE-2026-90898, JFSA-2026-001686326 (14 September 2026); The Hacker News (22 September 2026); GitLab Advisory Database entries for CVE-2026-77254 and CVE-2026-77255, mcp-atlassian (22 September 2026), upstream GitHub advisories (10 July 2026).
3
Research published this week shows that a person can approve one agent action while a materially different one executes, which undermines the control most organisations are relying on
Adithyan Arun Kumar submitted a paper on 17 September 2026 describing what the author calls loopjacking. The structure is that a human approves what they understand to be operation A, and the implementation applies that approval to operation B. Two variants are set out: attacks on what the approval screen represents, where B is concealed at the point of review, and post-approval substitution, where the approved operation is replaced before it runs. Behaviour was demonstrated in Agno AgentOS through 3.0.9, in a tested LangGraph Agent Server configuration through 0.14.0, and in OpenClaw 2026.2.23, which was fixed in 2026.2.24. The OpenAI Agents SDK, at 0.22.0 and 0.22.2, rejected the attacks and served as a negative control in the study. These were purposive test cases and not a survey, so they do not establish how widespread the pattern is.
Why it matters for IndiaHuman-in-the-loop approval is the control Indian enterprises have leaned on hardest while putting agents into change management, ticket handling, payment operations, data exports and SOC automation. It is what appears in the risk register and what is shown to an auditor, and it is frequently the only thing standing between an agent and a consequential action. The finding does not say approval is worthless. It says the binding between what was shown and what executes has to be built deliberately, and in several frameworks it was not. That matters more here because a large share of Indian agent deployments are assembled by an integrator on top of one of these frameworks, so the property is inherited rather than chosen.
ActionFor each agent workflow with an approval step, establish what exactly is being approved and whether the executing component receives the same object the reviewer saw, or only a reference that can be re-read later. Ask your integrator this question in writing. Upgrade OpenClaw to 2026.2.24 or later. Log the approved action and the executed action separately and compare them, since a divergence is detectable even when it is not preventable. For high-consequence actions, put a control that does not depend on the agent's own reporting, such as a payment limit or a separate authorisation at the target system.
SourceAdithyan Arun Kumar, "Loopjacking", arXiv 2609.21081 (17 September 2026).
4
Spain's data protection authority has logged the first breach notification it has received in which the attack was carried out by an autonomous AI agent
The Agencia Española de Protección de Datos received the notification on 14 September 2026. Its account is that a third party used an AI agent as the instrument for chaining the phases of the attack: the agent logged in using valid credentials, searched the application for weaknesses on its own, then modified personal data and accessed invoices, with no human operator directing the intermediate steps. The regulator has not named the affected organisation, the model provider, the vulnerability or the number of people whose data was involved. The account comes from the breached organisation and remains under review, so treat the technical detail as provisional. What is not provisional is the procedural point: an agent-executed intrusion has now entered the GDPR Article 32 and 33 breach-notification machinery as a category a regulator has recorded. It is worth being precise about what failed. On the facts released, this was valid credentials plus application weaknesses that a patient attacker would also have found. The agent supplied the patience. The harder question it raises is about accountability: when an agent chains actions under legitimate credentials, the logs show authorised activity, and reconstructing intent afterwards is a different exercise from reading an audit trail.
Why it matters for IndiaTwo reasons, and the compliance one is the nearer. Indian IT services firms, GCCs and product companies process EU personal data for clients under contractual terms that inherit these obligations, so this is a notification standard their customers will now be measured against. The second reason is domestic. CERT-In's reporting requirements and the Digital Personal Data Protection Act both assume an organisation can explain what happened, and an intrusion conducted entirely through valid credentials at machine speed is hard to explain from access logs alone. We are not aware of public reporting of an equivalent case before an Indian regulator, and an absence of reporting should not be read as an absence of the activity. The gap to close is the ability to answer the question if it is asked.
ActionReview your detection for authenticated sessions rather than for failed logins, since this activity was authenticated throughout. Rate of action within a session is the signal available to you: a valid account enumerating an application and modifying records faster than a person works is visible in application logs if anyone is looking. Make sure application-layer logs capture what was changed and not only that access occurred. Check that your incident response plan can describe a sequence of authorised actions as an incident, because most plans are written around unauthorised access. For teams handling EU personal data, confirm your notification timeline holds when the initial account of the incident is incomplete, which is the situation here.
SourceAgencia Española de Protección de Datos, breach notification received 14 September 2026; SecurityWeek, reported by Kevin Townsend (16 September 2026); Spanish coverage 15 to 18 September 2026.
AI defender tip: Read these four together and the common element is not a missing control. It is a control that was present and was believed. The plugin pin returned success while installing something else. The gateway's authentication existed and was off in the shipped configuration. The approval prompt collected a decision and applied it elsewhere. The access logs in the Spanish case recorded legitimate activity throughout, accurately, and that is exactly the problem. Every one of these would pass a control questionnaire, because a questionnaire asks whether the control is in place and not whether it binds to the thing you think it binds to. The exercise for this week is narrow enough to finish. Take the three agent or AI systems your organisation actually runs, not the ones in the strategy deck. For each, name the single control you would cite if asked why it is safe, then verify that one control from outside the system: connect to the gateway from another machine without credentials and confirm it refuses you; compare an approval record against what the target system recorded as executed; check that a pinned dependency is the commit you reviewed. Most teams will find at least one control that reports success without doing the work, and the useful part is that this is a checkable question with an answer, which is more than can be said for most items on an AI risk register.
Nirad Threat Research
Nirad AI Threat Watch | Bharat-first threat intelligence
