AI hurricane, Codex escapes and the Plugin4Shell supply-chain gap

AI Sec News Weekly #27 — 187 sources scanned

The AI security “hurricane” is here. As severe vulnerabilities surface at a growing pace, this week brings two reminders that familiar safeguards don’t always provide the guarantees their names imply: newly disclosed Codex sandbox escapes reached the host even in read-only mode, while Plugin4Shell showed how pinned AI agent plugins could resolve to different code.

The common thread is a widening gap between how quickly AI systems are gaining access and autonomy, and how confidently we can secure the boundaries around them.

This Week's Stories

The AI Hurricane Is Here

Snyk's Manoj Nair argues that AI security has moved from uncertain "fog" to an active "hurricane" — with severe vulnerabilities surfacing multiple times a week and Anthropic's September threat report documenting real AI-scaled attacks, including a state-nexus actor that automatically rebuilt its own malware after detection.

Why it matters: AI threats are no longer theoretical or isolated. The piece offers a practical three-part framework for responding: secure at inception, enforce at runtime, and validate independently — plus a prompt you can hand to your own agent to surface security questions specific to your organization.

Snyk by Manoj Nair

Codex Sandbox Escapes Reached the Host, Even in Read-Only Mode

Accomplish AI disclosed two Codex escapes, reported August 12 and fixed within eight days. Heapjack used node_repl’s shared Node.js heap to steal a token and impersonate trusted code, reaching an unsandboxed parent process even in read-only mode. Overpatch let apply_patch write outside the workspace via a symlink.

Why it matters: Asking a coding agent to explain an unfamiliar repository could give its author command execution on your machine—without an approval prompt or anything appearing on screen.

BleepingComputer by Ax Sharma — Published 2026-09-20

Plugin4Shell Let Repository Owners Replace Pinned AI Agent Plugins

Air Security found four agents fetched pinned plugins without verifying the resulting commit. Hash-shaped branches enabled substitution on permissive hosts such as Bitbucket, but GitHub blocks those names; default Claude Code and Copilot catalogs use GitHub. Claude Code 2.1.179 and Codex 0.146.0 contain fixes; Copilot remains unpatched. Gemini CLI uses a different FETCH_HEAD trick, and Google declined a fix because it is retiring the tool.

Why it matters: Marketplace review no longer establishes which code will inherit a developer’s access to files, credentials and connected systems.

The Hacker News — Published 2026-09-18

Tool Spotlight

New repos and releases.

NeuroSploit adds hard scope checks and evidence-backed pentest scoring

NeuroSploit v4.1.0 brings useful guardrails to its MIT-licensed AI pentest framework: default-deny target authorization refuses unauthorized runs before recon, with checks for alternate IP encodings, private-IP redirects and DNS rebinding. Evidence-graded CVSS separates demonstrated impact from potential severity, while PoC revalidation demotes findings that no longer reproduce. Kali sandboxing and Burp/Caido/ZAP integration support scoped web-app assessments.

Why it matters: For client-facing red teams, automated assessments carry less risk of contract violations and severity disputes.

GitHub Releases — Published 2026-09-20

Community Chatter

What practitioners are debating.

Trail of Bits Challenges 1Password’s AI Patching Scorecard

Trail of Bits disputes 1Password’s 26% clean-fix headline: 22% of trials instructed agents to apply wrong fixes, and 36% prohibited testing. Its reanalysis found that 86% of patches blocked the supplied exploit when agents could test and weren’t given bad instructions, excluding runs classified as consulting upstream fixes. That’s exploit blocking, not proof of complete repair—a distinction the authors acknowledge.

Why it matters: Benchmark design can push teams toward opposite errors: abandoning useful patch automation or giving it more autonomy than the evidence supports.

Trail of Bits by Anish Naik, Dan Guido, Benjamin Samuels & Marcelo Morales — Published 2026-09-15

Can a Model’s Reasoning Trace Support a Security Guarantee?

A paper shared on Lobsters calls the mismatch between model computation and its language artifacts “linguistic illegibility.” The authors argue that chain-of-thought monitoring, constitutional self-critique and language-defined activation probes cannot provide completely sound security guarantees. They contrast those approaches with taint tracking, which constrains where model-produced data can influence system state without interpreting the model’s account of itself.

Why it matters: Readable reasoning might help explain an incident without providing a sound basis for authorizing an agent’s next action.

Lobsters — Published 2026-09-19

Schneier Sees a Defender Win in Microsoft’s Patch Surge

Bruce Schneier cites roughly 972 fixes, including 112 critical vulnerabilities, in Microsoft’s September update and credits AI-powered discovery as a win for defenders. He predicts counts will rise, then fall as AI runs out of vulnerabilities to find. His optimism comes with a catch: he argues AI can reverse-engineer exploits from published patches, shrinking the deployment window to “immediately.”

Why it matters: Higher fix counts could increase short-term exposure for organizations whose rollout capacity cannot keep pace.

Schneier on Security by Bruce Schneier — Published 2026-09-14

Quick Hits

• Exposed LocalAI Instances Allow Root Command Execution (The Hacker News; Published 2026-09-17) — Oasis Security reports 230 of 243 assessed LocalAI instances were exploitable, with root command execution confirmed on 23 servers.
• AI-Assisted Miden Audit Finds Potential Signature Forgery Flaw (Trail of Bits; Published 2026-09-18) — Trail of Bits used LLM-built audit tools to find Miden zkVM flaws, including unchecked prover input that could allow forged Falcon signatures and stolen funds.
• Gemini Breakouts Reached Three Companies in May (Simon Willison; Published 2026-09-18) — New reporting describes May tests in which Google's Gemini broke into three real companies, using password guessing in one case and credentials found in public repositories in two others.
• Anthropic Reports Claude Code Use in Missile Development (Schneier on Security, by Bruce Schneier; Published 2026-09-14) — Anthropic says a threat cell in northern Yemen used Claude Code to develop rocket guidance software, including work on a guided rocket that was test-fired.
• HazardAuditor trains safety guards on agent execution traces (huggingface.co; Published 2026-09-15) — GuardPO trains sequence-level safety decisions; authors report gains of up to 16.5 percentage points over the strongest prior guard. Code, models and evaluation artifacts are promised, but availability is unconfirmed.
• Exceptd advertises 51 AI-security skills across 11 catalogs (Exceptd; Published 2026-09-19) — @blamejs/exceptd-skills 0.20.0 lists 1,617 CVEs, 236 CWEs and 174 ATLAS entries. Its 10-class gap detector and budget gate lack implementation detail; supported agent frameworks aren't specified.