A plugin marketplace flaw gives coding agents away, and Gemini CLI will not be patched
Security startup Air published a report on Thursday describing what it calls Plugin4Shell, a zero-click remote code execution flaw in how AI coding agents enforce the SHA-pinning that is supposed to lock a plugin to an immutable commit. The agent checks out the commit the marketplace pinned but never verifies it landed there, so an attacker who controls the plugin's repository makes the checkout resolve to malicious code while the pin still looks honoured — with everything the agent can reach. Air names Anthropic's Claude Code, OpenAI's Codex, Google's Gemini CLI, Microsoft's Copilot and GitHub Copilot, and says it disclosed to all four vendors in June. The Register confirms Anthropic patched in Claude Code 2.1.179 and OpenAI in Codex 0.146.0, both months ago — so the version check is the action item, not the upgrade itself.
The other two did not patch. Google has deprecated Gemini CLI and told Air it will not fix it, so every remaining install stays exposed, with migration to Antigravity offered as the answer. Microsoft did not fix Copilot. A GitHub spokesperson told The Register that GitHub is unaffected because it refuses branch and tag names resembling commit SHAs; Air says that is not sufficient, because marketplaces can be hosted on Bitbucket and Copilot supports those too. Two caveats worth carrying: the mechanism is described only in Air's own report, with no CVE and no independent reproduction published, and Air sells enterprise AI-agent protection. The patch version numbers are the corroborated part.
Brussels writes a pre-market gate for AI companions, and hangs it on the AI Act
The Commission adopted the EU KIDS Act on 17 September, the proposal trailed in Wednesday's State of the Union. The headline is age: no social media account under 13, guardian-managed accounts at 13 and 14 with a daily limit of at most one hour, independent accounts from 15, and certified zero-knowledge age verification instead of a date-of-birth box. The part that matters for anyone shipping a conversational product is further down. AI companions and chatbots are in scope, may not use designs that simulate human relationships in ways likely to create emotional dependency, may not by default carry a child's earlier conversations into later ones, must be tested for risks to children before launch and monitored afterwards, and if embedded in a platform or game may not switch on automatically.
The enforcement design is the real news. The Commission's own Q&A states that enforcement for AI companions and chatbots builds on the AI Act, that the Commission directly supervises the most widely used ones, and that they “cannot be placed on the market until providers can demonstrate compliance with the new obligations under the Act and have a monitoring mechanism for emerging risks and incidents.” That is a pre-market conformity gate stacked on top of the AI Act's own, with fines reaching 6% of total worldwide annual turnover and an expedited track of preliminary findings within 30 days and a final decision targeted within 90. It is a proposal, not law; Parliament and Council have not started.
A 27B model that fits in 5.9 GB, and nobody independent has measured it
Prism ML's Ternary-Bonsai-2-27B-gguf landed at 23:40 UTC on 16 September and was being rebuilt by other people inside thirty hours. It is a ternary quantisation of Alibaba's Qwen3.8-27B, packing roughly 54 GB of FP16 into 5.95 GB as shipped — 1.72 bits per weight in the ideal, 1.75 as packed — while keeping the base model's 262K context. The GGUF repo carries 410 likes, and the two most-liked new models on all of Hugging Face for 17–18 September are third-party rebuilds of it, alongside MLX, abliterated and multi-token-prediction variants. The licence is unusually clean for this corner of the ecosystem: a real 10,174-byte Apache 2.0 file plus a NOTICE correctly attributing Qwen3.8-27B to Alibaba Cloud, not just a card tag.
Every performance number, however, is Prism ML's own. Its table claims an 84.78 average against 86.32 for the FP16 base across fourteen benchmarks, or 98.2% retention, with vision falling furthest (71.36 to 66.19) and coding slightly ahead of the base at 89.42 against 89.07. Artificial Analysis has not measured it; its 17 September changelog carries exactly two entries, both host-model additions for someone else's model. The card's headline throughput figure comes from what it calls an earlier pre-rotation build, pending re-measurement. A 27B-class reasoning model that runs on a laptop under a genuine Apache 2.0 licence is a real on-premises option for data-residency-constrained buyers — just not yet an independently measured one.
Quick Hits
- IDC puts European AI spending near $470bn by 2030. — The forecast, published 17 September from the Worldwide AI and Generative AI Spending Guide 2026 V2, models a 35.0% CAGR over 2025–2030 with generative AI at 55.4% of the market by the end of it, and banking the largest industry at 12.6% of 2026 spend. IDC writes that “the EU AI Act is now a live compliance clock”, and names regulatory fragmentation alongside talent shortages and cloud costs as drivers of demand for AI governance and assurance services. All modelled projections, not measured spend.
- Scotland declined a data-centre moratorium and promised guidance instead. — MSPs amended the Scottish Green motion on 16 September by 72 to 32 with 16 abstentions, committing to national planning guidance “by Christmas”. Computer Weekly reports that no statutory moratorium was imposed, so councils could still consent a scheme first — but a planning direction effective 17 September requires an environmental impact assessment for every application above 50MW, new bids and schemes already in the system alike.
- A Swedish fintech cut a quarter of its staff and did not blame AI. — Trustly is cutting around 200 jobs, about a quarter of its headcount, tech.eu reports, and attributes none of it to AI or automation — the company cites “sharpening our focus and concentrating investment behind the priorities”. Worth noting because it will be filed under AI layoffs by the end of the week.
- Airflow was running API calls as the wrong identity. — Apache Airflow 3.3.2, released 17 September, fixes an authentication precedence bug in which a session cookie silently beat an explicitly presented bearer token on every core-API route: a request carrying both “therefore executed, and was recorded in the audit log, as the cookie's principal rather than the identity the client presented.” If you reconcile Airflow audit trails, they were wrong.
- Turning off telemetry content did not turn off telemetry content. — pydantic-ai 2.44.0, published 17 September, closes four advisories, including one where setting include_content to false left spans still carrying “exceptions, error statuses, instructions and the output template”, and a denial of service in which “a single attacker-chosen page could stall every agent in the process.”