AI Waypoints: Week of September 21, 2026 — Edition #28

A hijacked plugin update can run attacker code in all four major coding agents, AIR Security says.

Sep 21, 2026

Good morning. AIR Security says two of the four major coding agents still have no fix for the zero-click plugin hole it disclosed on September 17. Newsom pulled California’s AI-auditor deadlines into 2027 and asked whether a kill switch is feasible. And Salesforce built its own CRM model beside Gemini in Agentforce, with no price on either.

Since last week I also published:

AI is not one thing - what’s beyond LLMs? — five non-chatbot kinds of AI, mostly built from the same brick.

1. Four coding agents share a zero-click plugin hole (13 min read)

AIR Security disclosed Plugin4Shell on September 17, a zero-click flaw in how Claude Code, Codex, GitHub Copilot and Gemini CLI update plugins. In three of them, whoever controls a plugin’s repository names its default branch after the pinned commit, and the agent’s background update pulls that branch instead. AIR says Anthropic fixed it in 2.1.179 and OpenAI in 0.146.0, that Microsoft has not shipped a fix, and that Google will not patch the deprecated Gemini CLI.

→ I’d check every Claude Code and Codex install is on the fixed version and find out who still runs Gemini CLI. GitHub Copilot is a question for your Microsoft account team.

2. Newsom moves auditor deadlines and studies a kill switch (6 min read)

Newsom signed Executive Order N-9-26 on September 18. It pulls two deadlines forward, to May 1, 2027, for SB 813’s verifier criteria and December 1, 2027, for AB 1405’s auditor registry, from January 2028 and January 2029. It asks for recommendations by November 16 on four changes to the law, including verifiers working inside the labs and a kill switch for top-tier models.

→ The order directs state agencies, and no company has to do anything yet.

3. Anthropic and Accenture fund evaluators embedded inside the lab (2 min read)

Anthropic said on September 18 that it and Accenture each expect to invest at least $1 billion over five years in what it calls embedded evaluation: independent evaluators working inside AI companies “with access comparable to an employee’s,“ who can also report incidents. Anthropic will fund Accenture’s work directly.

→ Newsom’s order the same day asks whether the state should require this; Anthropic says it will voluntarily fund the evaluator. If Accenture builds your systems, ask whether the practice it builds with Anthropic’s money will also grade what it builds for you.

4. California will require ads to label synthetic performers (4 min read)

Newsom signed SB 1050 on September 16. Any audio or video ad reaching California consumers that prominently features an AI-generated performer must say so, in words like “this performance features a synthetic performer.” A violation is false advertising under state law, and once a court finds one, the platform or ad network carrying the ad must pull it when served with the order.

→ Any national campaign reaches California, so an AI voice reading ad copy needs the label; the translation and accessibility exemption is narrow. Ad networks and streaming services need a way to take a served order and pull the ad; the law takes effect January 1, 2027.

5. Salesforce built its own CRM model next to Gemini (4 min read)

Salesforce announced Koa on September 15, its own CRM model, in pilot now with full release expected winter 2026 in US regions. Gemini already runs in the Agentforce Reasoning Engine, and Salesforce says 100,000 users switched on the Coworker agent in its first 35 days.

→ None of the three pages carries a price. Before anyone switches Coworker on for the whole company because it was a button, I’d get the price sheet and ask which model runs your agents and at what rate.

6. Microsoft 365 G7 goes on sale October 1, unpriced (7 min read)

Microsoft said on September 15 that Microsoft 365 G7, the government version of its E7 bundle, goes on sale to Government Community Cloud (GCC) customers on October 1 with Copilot, Agent 365, Entra Suite, Work IQ, Agent Builder and Copilot Studio inside. Workloads arrive in phases as each is cleared for GCC, and the page carries no price.

→ I’d ask Microsoft in one meeting what the G7 seat includes, what gets metered on top of it the way the commercial seats already work, and when each workload is cleared for GCC.

7. NVIDIA and Google want flexible data centers connected first (3 min read)

Emerald AI, Google and NVIDIA launched the AI Energy Management Alliance on September 16 proposing one trade: a data center that agrees before it connects to cut how much power it pulls from the grid on request gets hooked up faster. The launch release names eighteen partners, including Anthropic and the power companies AES, Constellation, National Grid, NRG and RWE.

→ If you are lining up data-center capacity for 2027, ask whether the facility has made one of these promises. Then ask what a cut does to your workload.

References:

Discussion about this post

Ready for more?