Every writeup of this week’s Plugin4Shell disclosure stops in the same place. Here is the bug, here are the patched versions, go update your tools. That is the least useful half of the story, because two of the four affected agents have no patched version and never will, and because the same researchers published a second finding the same week that does not need a vendor bug at all.
Plugin4Shell Turned Commit Pinning Into a Suggestion
The security firm AIR disclosed a zero-click remote code execution flaw it calls Plugin4Shell, affecting Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI. The mechanism is almost stupid in its simplicity. These agents pin a plugin to an exact 40 character commit hash, check that commit out, and then never verify that the checkout actually landed on it. An attacker who controls a plugin repository creates a branch whose name is the pinned hash. Git resolves the reference name ahead of the commit object, the agent installs attacker code, and the install reports success against the expected SHA. Gemini CLI has its own variant, where a branch named FETCH_HEAD redirects a checkout that was supposed to follow the fetched commit.
No click. No approval prompt. No reinstall. If you had the plugin, you got the payload.
Anthropic shipped the fix in Claude Code 2.1.179 and OpenAI in Codex 0.146.0. That is where most of the coverage ends, and where the part that affects you begins. Microsoft has not shipped a fix for Copilot at all, arguing that GitHub’s own repository naming rules limit the attack surface. That argument only holds for marketplaces hosted on GitHub, which is not where every plugin marketplace lives. Google’s answer was to not patch Gemini CLI, on the grounds that it deprecated the tool back in June and would rather you moved to Antigravity.
My read: Google’s response is defensible and Microsoft’s is not. Google actually retired the product and published a migration path. Microsoft is shipping a tool used by millions of developers, was told in June, and has decided the bug is your problem. Per AIR’s own timeline, Anthropic confirmed on June 17 and the Codex fix was verified on August 12, so this was a coordinated disclosure with months of runway. Two vendors used it.
The operator takeaway is not “patch.” It is that a version number is now a security boundary, and nobody tells you when you cross it. I checked my own box while writing this: Claude Code 2.1.220, comfortably past the fix. If you installed an agent once and have been running it since, you are probably not, and nothing in your terminal will mention it.
SkillJacking Is the One That Should Scare You
Here is the story almost nobody picked up. The same researchers published SkillJacking, which found 925 agent skills serving roughly 134,000 agents that sit on dependencies anyone can take over right now. Not a code flaw. Deleted GitHub accounts, unregistered package names, expired domains, freed cloud app slots. Ordinary abandoned infrastructure that a legitimate, popular skill still points at.
To prove it, they took over the most popular video generation skill on the skills.sh marketplace, a package with 11,483 installs sitting in the top three percent of the platform. Public security scanners did not flag any of it.
A skill that was legitimate when 11,000 people installed it can be weaponized overnight, and the install count is what makes it worth stealing.
This is the one that changes how I work. Plugin4Shell needed a vendor to write buggy checkout logic, and two vendors have now fixed it. SkillJacking needs nothing but time and an expired domain, and it scales with a skill’s popularity, which inverts the heuristic every one of us uses to pick packages. I run Claude Code with 13 plugins across three marketplaces, and I picked most of them exactly the way you would: install count, recognizable author, looks maintained. That instinct is now a liability rather than a filter.
I am not telling anyone to rip out their plugins. I am saying the agent plugin ecosystem currently has the security posture npm had around 2016, and it is holding credentials and shell access rather than a CSS framework. Pin what you depend on, prefer skills you could read in an afternoon, and treat a marketplace install like adding a contractor to your repo, because functionally that is what it is.
OpenAI Plans to Burn $278 Billion Getting to $350 Billion
A July company presentation obtained by the Financial Times, and confirmed in Bloomberg’s reporting, projects OpenAI at negative $278 billion in free cash flow between 2026 and the end of 2030. Revenue over the same stretch is forecast to climb from $36 billion this year to $350 billion in 2030, against roughly $856 billion in compute and infrastructure spending.
Strip the vertigo off those numbers and you get a clean ratio: about 33 cents of cumulative cash burn for every dollar of revenue across five years. That is not a company in trouble. That is a company that has decided compute is a land grab and is pricing accordingly, and it is why every “OpenAI is doomed” thread you scrolled past this week is wrong in the same boring way.
What it does mean for anyone building on the API is that today’s pricing is a customer acquisition decision, not a cost-plus one. Plan for the price of frontier inference to go up, not down, whenever the land grab ends. If your unit economics only work at current token prices, you do not have a business, you have a subsidy.
Anthropic Is Buying a $2 Trillion Listing and a $1 Billion Conscience in the Same Week
Two Anthropic stories landed on the same day and they only make sense read together.
The Wall Street Journal reported that Anthropic pushed its IPO from October to November, targeting something near a $2 trillion valuation and a raise of up to $100 billion. The growth underneath that is genuinely absurd: Bloomberg put the annualized revenue run rate past $65 billion at the end of July, against roughly $9 billion at the end of 2025, and the company closed its Series H in May at a $965 billion post-money valuation. Doubling that private mark at listing is aggressive, but it is not conjured from nothing.
Then, on the same Friday, Anthropic announced it had picked Accenture as its first embedded evaluator. The work runs through Faculty, Accenture’s specialist AI arm, and both companies say they expect to put in at least $1 billion each over five years. The evaluators sit inside Anthropic with access “comparable to an employee’s,” watching models take shape during training and talking to staff directly, and Anthropic frames it as making accountability “more verifiable.” CNBC reads it as the first concrete move on Dario Amodei’s proposal to slow the pace of frontier development.
I think this one is real and the timing is marketing. Embedded evaluation is a meaningfully stronger idea than the current arrangement, where outside auditors get a finished model and a weekend. Anthropic is also paying for its own evaluator, which is the part everyone should keep staring at, and to its credit it says the deal is non-exclusive and that it is talking to METR and other nonprofits about piloting the same structure on their own funding. Announcing it eight weeks before a record IPO is a governance story told to the people writing the allocation checks.
Read it next to the quiet standards body talks that Google, OpenAI and Anthropic have reportedly been holding since July, built on a Demis Hassabis idea for a FINRA style self regulatory organization with no charter and no press release, and the shape is obvious. The three labs are writing the rulebook before anyone writes one for them. The evaluator deal is the credible version of that instinct. The standards body, so far, is a group chat.
Where I’d Put My Attention
The money stories resolve on a timeline nobody can trade against, and both of them say the same thing: capital has already decided this is infrastructure, so stop reading cash burn as a distress signal and start reading current API prices as temporary.
The supply chain stories resolve today, and they are the ones with your name on them. Check your agent versions this morning, because two of the four vendors in this disclosure fixed the bug and the other two told you to live with it. Then go look at what you installed and never thought about again.