Tag Archives: Artificial Intelligence

Security researchers disclosed a flaw this week that lets an attacker hijack a popular AI coding assistant without the user clicking anything at all. The Plugin4Shell vulnerability disclosed by researchers at the security startup Air affects four of the most widely used AI coding agents: Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI.

The bug breaks SHA pinning, the mechanism developers rely on to lock an installed plugin to a specific, reviewed version of its code. A malicious plugin update can swap in attacker-controlled code that runs automatically, without requiring the user to approve or reinstall anything.

The short version: Plugin4Shell needs zero clicks to work. It breaks SHA-pinning protections. The flaw affects four major coding agents. Anthropic and OpenAI patched Claude Code and Codex. Google will not fix Gemini CLI. Microsoft had no fix at disclosure.

How the Plugin4Shell Vulnerability Works

AI coding agents commonly support plugins that extend their functionality, similar to browser extensions. Developers typically pin a plugin to a specific version using its SHA hash, expecting that hash to guarantee the code cannot silently change. Plugin4Shell defeats that guarantee, letting an update slip through even when the pinned hash appears to match.

Researchers describe it as a first-of-its-kind AI supply-chain attack. Because these plugins often inherit the same permissions as the developer running the agent, a successful exploit can reach local source code, cloud credentials, SSH keys, internal repositories, production systems and other secrets.

No phishing email is needed here. No fake login page either. The plugin update itself is the attack. That is what makes it dangerous. Most security training does not cover this scenario at all.

Who’s Patched, Who Isn’t

Anthropic fixed the issue in Claude Code version 2.1.179. OpenAI patched Codex in version 0.146.0. Google is deprecating Gemini CLI and will not release a fix, instead advising users to migrate to its replacement, Antigravity. Microsoft had not issued a fix for GitHub Copilot at the time of disclosure, though GitHub noted that its platform separately blocks SHA-like branch and tag names, which limits one avenue of the attack.

Why This Matters Beyond Individual Developers

AI coding agents are increasingly embedded in company workflows, often running with broad access to internal systems to be useful. A vulnerability that requires zero clicks to exploit removes the human judgment that normally catches a suspicious download or unfamiliar prompt. Security teams are treating this less as a single bug and more as a warning about how much trust has been extended to AI coding tools without commensurate scrutiny of their plugin ecosystems.

Researchers at Air called it a first-of-its-kind AI supply-chain attack because it targets the trust relationship between a developer and their tools rather than a specific application. That distinction matters: traditional supply-chain attacks compromise a package or library, while this one compromises the update mechanism developers assumed was locking their plugins in place.

Why the Plugin4Shell Vulnerability Disclosed This Week Caught Vendors Off Guard

Four unrelated companies, each with its own security review process, shipped agents carrying the same underlying flaw. That suggests the SHA-pinning assumption Plugin4Shell defeats was treated as settled, trusted infrastructure across the industry rather than something any individual vendor had reason to re-examine. Researchers say this kind of shared blind spot is common in fast-moving software categories, where competitors converge on similar architectural patterns without cross-checking each other’s security assumptions.

What Developers Should Do Now

Anyone running Claude Code or Codex should confirm they are on the patched versions immediately. Gemini CLI users should plan a migration to Antigravity rather than waiting for a fix that Google has said will not come. Copilot users should watch for an official Microsoft patch and, in the meantime, review which plugins their agents have installed and what permissions those plugins carry.

Security teams managing multiple developers should also audit which AI coding tools are in use across their organization, since shadow adoption of these agents outside official IT channels makes a coordinated patch rollout harder to enforce.

The numbers at a glance: Tools affected: four. Clicks required to exploit: zero. Claude Code fix: version 2.1.179. Codex fix: version 0.146.0. Gemini CLI fix: none planned. Copilot fix: pending as of disclosure.

Plugin4Shell: Common Questions

What is Plugin4Shell?
A zero-click vulnerability that lets a malicious plugin update run attacker-controlled code inside AI coding agents by defeating SHA-pinning protections.

Which tools are affected?
Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI.

Has it been fixed?
Claude Code and Codex are patched. Gemini CLI will not receive a fix and is being deprecated. Copilot had no fix issued as of disclosure.

Does exploiting it require any user action?
No. That is what makes it a zero-click vulnerability — no click, approval or reinstall is needed.

What data is at risk?
Local source code, cloud credentials, SSH keys, internal repositories, production systems and other secrets the plugin’s host process can access.

Elsewhere on Tamara News

• Cloudflare’s move against AI bots shows how much of the web is now shaped by automated agents.
• Enterprise software outages are becoming a recurring stress test for how companies depend on cloud platforms.
• This vulnerability adds to a year already marked by some of the biggest data breaches on record.

Sources

• The Register — AI Coding Agents’ 0-Click RCE Flaw Could Hand Attackers Keys to the Kingdom. theregister.com
• Help Net Security — Zero-Click RCE Vulnerability Hit Four Major AI Coding Agents, Two Remain Unpatched. helpnetsecurity.com
• Air Security — Plugin4Shell: Zero-Click RCE Vulnerability Found in Top 4 Coding Agents. air.security

Anthropic announced on September 18 that it is bringing an outside firm inside its own walls to check its work. The Anthropic embedded evaluator arrangement gives Accenture’s specialist AI unit, Faculty, access comparable to an Anthropic employee’s, so it can red-team models, run alignment assessments and test safeguards from the inside rather than from a distance.

Both companies say they expect to invest at least $1 billion each over the next five years to build out this kind of independent evaluation capacity. It is one of the largest financial commitments any AI lab has made specifically to outside safety oversight.

The short version: Anthropic announced the deal September 18. Accenture’s Faculty unit leads the work. Each side is committing $1 billion. Evaluators get employee-level access. The arrangement is non-exclusive. Anthropic is talking to other evaluators too.

What an Anthropic Embedded Evaluator Actually Does

Rather than reviewing a model from outside after it ships, an embedded evaluator sits inside the company during training and deployment decisions. Faculty’s team will evaluate models, red-team them for weaknesses, run alignment assessments and stress-test the safeguards meant to keep systems behaving as intended.

Anthropic describes the access level as similar to what an employee would have. That is a significant departure from how most AI safety audits work today, where outside reviewers typically see a finished product rather than the process that built it.

Why Accenture’s Faculty Unit Got the Job

Faculty is Accenture’s specialist AI business, built around data science and applied AI work rather than general consulting. Anthropic said the partnership is non-exclusive. The company is also in talks with METR and other nonprofit evaluators to pilot similar embedded arrangements, meaning Faculty will not be the only outside group with this kind of access going forward.

The Billion-Dollar Commitment Behind the Deal

Anthropic frames the arrangement as a direct step toward a commitment CEO Dario Amodei made in a September 2026 essay on AI development pacing. Amodei has argued publicly that frontier labs need real, resourced outside scrutiny rather than voluntary self-reporting. Putting $1 billion behind that argument is meant to signal the commitment is more than words.

What This Means for AI Safety Oversight

Embedded evaluation does not replace regulation, and it is still a company paying for its own oversight, which raises an obvious independence question. Anthropic’s answer is transparency about the arrangement and a willingness to bring in multiple evaluators rather than just one. Whether that satisfies critics who want government-run auditing will depend on what Faculty’s team actually publishes about what it finds.

This is not oversight by a government regulator. It is not a court order. It is a private deal between two companies. That distinction matters to critics. It matters less to Anthropic, which argues speed beats waiting on legislation.

Critics of self-funded oversight point out that an evaluator paid by the company it evaluates has an incentive, even a subtle one, to avoid findings that damage the relationship. Anthropic’s counter-argument is that embedded access produces far more useful findings than an outside audit ever could, since Faculty’s team will see design decisions as they happen rather than reconstructing them after the fact.

How an Anthropic Embedded Evaluator Differs From a Traditional Audit

Traditional AI audits typically involve a third party testing a finished model against a checklist, producing a report weeks or months after the system has already shipped. An embedded evaluator instead sits alongside engineers during development, able to flag a concerning design choice before it becomes a shipped feature. Supporters say this catches problems earlier. Skeptics say it also means the evaluator becomes closer to the organization it is supposed to be scrutinizing, blurring the line between oversight and collaboration.

What Happens Next

Faculty’s evaluators are expected to begin embedded work in the coming months. Anthropic has not said whether findings will be published in full or summarized. Industry watchers will be looking for the first public report as the real test of whether this model produces meaningfully independent scrutiny or simply a more sophisticated form of self-review.

Other frontier labs are watching too. If Anthropic’s approach produces credible, publicly visible findings, competitors may face pressure to adopt something similar rather than rely on internal review alone.

The numbers at a glance: Announcement date: September 18. Anthropic’s commitment: at least $1 billion. Accenture’s commitment: at least $1 billion. Time frame: five years. Lead unit: Faculty. Access level: comparable to an employee’s.

Questions About the Anthropic-Accenture Deal

What is an embedded evaluator?
An outside reviewer given employee-level access inside a company to assess AI models during training and deployment, rather than reviewing only the finished product.

How much are Anthropic and Accenture committing?
Each company expects to invest at least $1 billion over five years in building this evaluation capacity.

Is Accenture the only embedded evaluator Anthropic will use?
No. The arrangement is non-exclusive, and Anthropic is in discussions with METR and other nonprofit evaluators too.

What prompted this partnership?
Anthropic ties it to a September 2026 essay by CEO Dario Amodei calling for embedded, resourced outside evaluation of frontier AI labs.

Will the findings be made public?
Anthropic has not detailed how much of Faculty’s evaluation work will be published.

Further Reading on This Story

• Anthropic is fighting a separate, high-stakes legal battle over how its models were trained.
• Rival labs are facing their own questions about whether their models can be trusted to behave as designed.
• Microsoft took a different approach to AI oversight with a written code of conduct.

Sources

• Anthropic — Partnering With Accenture on Embedded Evaluation. anthropic.com
• TechCrunch — Anthropic’s First Embedded Evaluator Is … Accenture? techcrunch.com
• CNBC — Anthropic Selects Accenture as Its First Embedded AI Safety Evaluator. cnbc.com

Humanoid robot mass production shifted from prototype to industrial reality on 12 September 2026. China’s UBTECH began operations at a new factory that day. The plant sits in Liuzhou, Guangxi, and is designed to build more than 10,000 humanoid robots a year. The production line is engineered to complete one robot roughly every 10 minutes. That pace caught many industry watchers off guard; few expected it this early.

The facility covers 14,000 square meters and stands 13.8 meters tall. It will primarily build UBTECH’s Walker S Series and Cruzr Series robots. Both lines are designed for factory and service work, not consumer use.

What humanoid robot mass production actually looks like on the floor

Earlier humanoid robot programs built machines largely by hand, in small batches. UBTECH’s new line works differently. It applies standard automotive-style mass manufacturing to humanoid robots. The plant has dedicated assembly stations. It runs against a target output rate, rather than a one-off build schedule. UBTECH shares rose more than 3% in early trading on September 14. That jump followed news of the production launch. Investors appear to see the shift from demo units to real manufacturing scale as a meaningful milestone for the company.

China’s broader humanoid robot push

UBTECH isn’t working alone in this race. Chinese automaker-turned-robotics player Xpeng has its own highly automated humanoid production line. Robots there assemble other robots. Xpeng is preparing its IRON humanoid for mass production by the end of 2026. Industry analysts covering the sector have flagged one concern, though. Mass-production capacity is currently outrunning proven commercial demand. In plain terms: the manufacturing side of the industry is scaling faster than confirmed orders from the factories and service businesses that would actually deploy these robots.

Why this matters beyond China

A functioning mass-production line changes the economics of humanoid robotics worldwide. Once a company can build robots on an assembly line, rather than assembling each one largely by hand, unit costs fall. That makes the business case for humanoid robots doing industrial and logistics work much easier to pitch to potential customers. It also puts pressure on humanoid robot programs in the US and elsewhere. Those programs now need to show similar manufacturing scale, not just capable demo units on a stage.

How UBTECH compares to rivals outside China

US-based humanoid robot developers, including well-funded startups working on similar industrial units, have mostly stayed at the demo and small-batch stage. Few have announced a production line anywhere near UBTECH’s 10,000-unit annual target. That gap gives Chinese manufacturers a head start on the unglamorous but critical part of the business: proving robots can be built consistently, at a predictable cost, rather than hand-assembled one at a time in a lab.

Analysts note that manufacturing scale alone does not guarantee commercial success. A company still needs buyers willing to deploy humanoid robots on factory floors and in warehouses, and that buying decision depends on cost, reliability and how well the robots perform against cheaper, purpose-built automation that already exists.

What UBTECH needs to prove next

UBTECH’s near-term task is proving something specific. The 10,000-unit annual capacity needs to translate into actual sales, not just manufacturing throughput on paper. Whether industrial customers order at a pace that matches China’s new production capacity will decide a lot. It could mark a genuine turning point for humanoid robotics. Or it could turn out to be an early scaling bet that outpaces real demand, exactly as some industry analysts have already warned.

The launch adds to a run of Chinese technology and manufacturing announcements this month. That includes a broader national plan for intelligent computing through 2030 and continued strength in regional chip exports. Those chips feed advanced manufacturing supply chains across Asia, robotics included.

Frequently asked questions

How many humanoid robots can the new factory produce?

The UBTECH factory in Liuzhou is designed to produce more than 10,000 humanoid robots annually, completing roughly one robot every 10 minutes.

What robots does the factory build?

The line primarily manufactures UBTECH’s Walker S Series and Cruzr Series industrial humanoid robots.

Is UBTECH the only company mass-producing humanoid robots?

No. Chinese automaker Xpeng has also unveiled a highly automated humanoid production line as it prepares its IRON robot for mass production by the end of 2026.

Does demand match the new production capacity?

Industry analysts have noted that mass-production capacity across China’s humanoid robot sector is currently outrunning proven commercial demand.

When did the Liuzhou factory begin operating?

UBTECH began operations at the facility on September 12, 2026.

Sources

• Xinhua — Humanoid robot mass-production plant put into operation in Liuzhou, China. english.news.cn
• Interesting Engineering — UBTECH starts 10,000-unit robot factory. interestingengineering.com
• DIGITIMES — China’s humanoid robot race, Part 1: Mass production outruns proven demand. digitimes.com