KDCube
← AI Industry News

Plugin4Shell Hits Coding Agents, Safari Ships MCP, Agentforce Goes Long-Horizon

Plugin4Shell, a zero-click RCE that defeats plugin SHA-pinning, hit Claude Code, Codex, Copilot, and Gemini CLI — only two vendors have patched. Meanwhile Safari 27 shipped a native MCP server with no MDM off switch, and Salesforce gave Agentforce a durable long-horizon runtime that pursues goals over weeks.

Highlights

  • Plugin4Shell, a zero-click RCE that bypasses plugin SHA-pinning, hit Claude Code, Codex, GitHub Copilot, and Gemini CLI — two vendors have patched, two have not (Help Net Security)
  • Apple shipped a native MCP server in Safari 27 — the first major browser to do so — but left enterprises with no MDM key to turn it off (Forkast)
  • Salesforce gave Agentforce a long-horizon runtime with durable execution and cross-session memory, debuting on its outbound-sales agent "Hunter" (Salesforce)

Key Signals

  1. Plugin4Shell breaks the SHA pin coding agents trust

    Disclosed June 2026 · patch status reported Sept 17–18

    Researchers at AIR found that an attacker controlling a plugin repo can name a Git branch to match a 40-character commit hash, tricking the agent into checking out malicious code while reporting the approved SHA as installed — a zero-click supply-chain path into any host running the agent. Anthropic (Claude Code 2.1.179) and OpenAI (Codex 0.146.0) shipped fixes; Microsoft's Copilot has not, and Google deprecated Gemini CLI rather than patching, leaving existing installs exposed (Help Net Security, Cyber Security News).

  2. Safari 27 turns the browser into an MCP surface — with no off switch

    Safari 27 GA · reported Sept 20

    WebKit's built-in MCP server exposes DOM, network, screenshots, and console to agents via safaridriver --mcp, running local-only in an isolated automation window (WebKit). The catch for operators: Apple's macOS enterprise release notes ship no MDM payload to disable it, so a user can enable a powerful automation interface through Developer settings and security teams can't enforce policy against it (Forkast).

  3. Salesforce's long-horizon runtime pushes agents from chats to weeks

    Portfolio announced ~Sept 15–16

    Alongside seven named "job-ready" agents, Salesforce introduced a runtime built for goals that span days and weeks — durable execution that persists and course-corrects plans, multi-session memory, and dynamic steering that updates config on the fly. Hunter, an outbound-sales agent, is the first to run on it and enters pilot ahead of a November release (Salesforce, PPC Land).

Why It Matters / What To Watch

  1. Your coding-agent plugin chain is now an attack surface.
    • Confirm you're on patched builds (Claude Code ≥2.1.179, Codex ≥0.146.0) and inventory any Copilot or Gemini CLI installs that remain exposed (Help Net Security).
    • SHA pinning alone no longer guarantees integrity — treat plugin repos as untrusted supply chain and watch how the remaining vendors respond (Cyber Security News).
  2. MCP is spreading to endpoints faster than governance can follow.
    • A browser MCP server with no MDM control means agent-reachable surfaces can appear on managed Macs without an enforceable kill switch — audit which endpoints can expose one (Forkast).
    • The isolation model (dedicated automation window, no cookies/passwords) is the right default; watch whether Apple adds enterprise controls before agents lean on it in production (WebKit).
  3. Long-horizon runtimes change what "running an agent" costs.
    • Durable, multi-week execution means state, memory, and steering become first-class operational concerns, not chat-session ephemera — plan for persistence and course-correction observability (Salesforce).
    • Salesforce says customers will eventually build their own long-horizon agents; watch for how memory and durable execution get exposed and governed (PPC Land).

Quick Links