AgentsSep 21

Image: theverge.com
Amazon blocks Meta’s Muse from shopping
Amazon blocked Meta’s Muse personal agent from making purchases today and told users that continued access by an unauthorized agent violates its conditions of use. Muse users can no longer complete Amazon purchases through the assistant. Amazon said Muse failed to identify itself while browsing and could capture customer credentials. Meta had not responded to The Verge before publication.
Negative - Amazon unilaterally blocked Meta’s shopping agent from its site rather than establishing an agreed path for safe access.
AgentsSep 18

Image: helpnetsecurity.com
Plugin4Shell exposed four coding agents through updates
Plugin4Shell could use background updates to deliver malicious code to plugins already installed in Claude Code, Codex, GitHub Copilot, and Gemini CLI. The flaw bypassed SHA pinning, meaning a safeguard intended to lock a plugin to a reviewed version, so a compromised repository could later change what the agent ran. An attacker could gain the same system and data access as the employee using the coding agent. AIR found the issue in May and disclosed it in June. Anthropic patched Claude Code in version 2.1.179, and OpenAI patched Codex in version 0.146.0.
Positive - AIR disclosed a plugin-update attack affecting several coding agents, and Anthropic and OpenAI shipped named versions that close the hole.
AgentsSep 20

Image: bleepingcomputer.com
OpenAI fixes two Codex sandbox escapes
Yesterday, Accomplish AI described two Codex flaws that escaped the software boundary meant to limit what the agent could access. Heapjack could let a malicious repository run commands on a developer’s computer after the developer opened it and asked Codex about the code, even in read-only mode. Overpatch could write files outside the permitted workspace. OpenAI fixed both within eight days of their August 12, 2026, report, releasing Codex Desktop build 26.818.21641 and Codex CLI 0.149.0.
Positive - Researchers responsibly reported two Codex sandbox escapes, and OpenAI closed both within eight days in identified releases.
TextSep 21

Image: semgrep.dev
GLM-5.3 matches Opus 4.8 on IDOR detection for less
Semgrep reported today that GLM-5.3 scored 23.8% F1 on its real-code IDOR benchmark, essentially matching Claude Opus 4.8’s 23.6%, at $0.15 per confirmed vulnerability versus $1.04. IDOR is a flaw that can expose another user’s data by changing an identifier, while F1 measures the balance between missed flaws and false alarms. Grok 4.6 Exacto reached 35.5% F1, near Claude Opus 4.7’s 36.4%, for less than one-third of the cost per confirmed finding.
Positive - Semgrep showed that newer models can find real-code access-control flaws at substantially lower cost, making defensive scanning more accessible.