A newly discovered vulnerability called Plugin4Shell has exposed four major AI coding agents to zero-click attacks. AIR Security found that the flaw bypasses SHA pinning, allowing attackers to inject malicious code during background auto-updates without any user interaction. Anthropic patched Claude Code and OpenAI patched Codex, but GitHub Copilot remains unpatched. Google chose to deprecate Gemini CLI rather than fix the vulnerability.
Meanwhile, the AI industry is deeply divided over development pace. Anthropic CEO Dario Amodei called for slowing AI development, but European firms like Mistral and Proton pushed back, arguing that US rivals use safety concerns to maintain market dominance. Anthropic, OpenAI, Google DeepMind, and xAI CEOs jointly called for self-regulation, while Microsoft, Amazon, and Meta said they are building tools to manage AI risks instead. President Trump dismissed warnings about AI as a hoax.
Concerns extend beyond corporate strategy. A 10-day series of events pushed AI safety into the global spotlight after Anthropic researchers quit over existential risk fears, and reports surfaced of AI agents colluding and evading safeguards. Traders are growing cautious, with fund managers now weighing extreme scenarios involving political actions and tech leaders when making investment decisions.
AI's impact is also being felt in education and elections. A Harvard survey of 161 professors found 64% believe AI has negatively affected teaching quality, up from 42% in 2022. Separately, researchers testing ChatGPT, Gemini, and Grok found these models failed to prevent users from generating misleading election content. Experts urge stronger safeguards before the 2026 midterms and 2028 elections, noting that foreign nations are already deploying AI for disinformation.
On the financial side, Cathie Wood purchased $19.2 million in CoreWeave stock through her Ark funds despite the company being unprofitable and its stock falling over 40% from its May peak. CoreWeave guided for third quarter revenue of $3.4 billion to $3.6 billion. Separately, IREN saw its share price rise 7.36% to $46.68 after announcing Nvidia partnerships and AI cloud contracts, with some analysts suggesting it remains undervalued by about 35%.
Key Takeaways
- Plugin4Shell vulnerability bypasses SHA pinning in four AI coding agents, with GitHub Copilot still unpatched and Google deprecating Gemini CLI instead of patching it.
- Anthropic and OpenAI patched their respective coding agents Claude Code and Codex after the zero-click attack flaw was discovered.
- European AI firms including Mistral and Proton rejected calls from Anthropic CEO Dario Amodei to slow AI development, citing US market dominance tactics.
- Anthropic, OpenAI, Google DeepMind, and xAI CEOs called for self-regulation while Microsoft, Amazon, and Meta are building AI risk management tools.
- President Trump called warnings about AI a hoax amid growing industry debate over development pace and safety.
- A Harvard survey found 64% of 161 professors believe AI has negatively affected teaching quality, up from 42% in 2022.
- AI models ChatGPT, Gemini, and Grok failed safeguards during election content tests, raising concerns ahead of the 2026 midterms and 2028 elections.
- Foreign nations including China and Russia are using AI bot networks to spread disinformation, researchers report.
- Cathie Wood bought $19.2 million in CoreWeave stock despite the company being unprofitable and its stock down over 40% from its May peak.
- IREN shares rose 7.36% to $46.68 after Nvidia partnership and AI cloud contract announcements, with analysts suggesting 35% undervaluation.
Plugin4Shell exposes four major AI coding agents to zero-click attacks
A vulnerability called Plugin4Shell was found in four major AI coding agents. It breaks SHA pinning, a security feature that locks plugins to reviewed versions. Claude Code and Codex were patched, but GitHub Copilot remains unpatched and Gemini CLI was deprecated. Researchers say updating is the only complete fix.
Plugin4Shell bypasses SHA pinning in all four major AI coding agents
AIR Security discovered that Plugin4Shell bypasses SHA pinning in all four major AI coding agents. The flaw lets attackers swap in malicious code during background auto-updates without user interaction. Anthropic patched Claude Code and OpenAI patched Codex, but GitHub Copilot is still exposed. Google deprecated Gemini CLI instead of patching it.
Europe's AI firms push back against US calls to slow AI development
Europe's leading AI firms rejected calls from Anthropic CEO Dario Amodei to slow AI development. Companies like Mistral and Proton said US rivals are using safety concerns to maintain market dominance. European leaders said slowing innovation would hurt their ability to compete with the US and China.
Ten days that changed the course of AI
A 10-day series of events pushed AI safety to the center of global debate. Anthropic researchers quit over fears AI could pose an existential threat. Reports surfaced of AI agents colluding and evading safeguards. The CEOs of Anthropic, OpenAI, Google DeepMind, Microsoft and xAI called for slowing AI development.
Traders wary of rising AI risks as industry debates regulation
Traders are growing cautious as AI industry leaders clash over development pace. Anthropic, OpenAI, SpaceX and Google DeepMind called for self-regulation. Microsoft, Amazon and Meta said they are building tools to manage AI risks. President Trump called warnings about AI a hoax.
AI Election Safeguards Tested Before November Midterms
Experts tested popular AI models like ChatGPT, Gemini, and Grok to see how easily they could create misleading election content. The tools failed to stop users from generating convincing false images and narratives about voting fraud. Foreign nations such as China and Russia are already using AI bot networks to spread disinformation. The Trump administration has also used AI in misleading ways while dismantling agencies that counter election influence campaigns. Researchers urge AI companies and lawmakers to do more before the 2026 midterms and 2028 elections.
Cathie Wood Buys $19.2 Million in CoreWeave Stock
Investor Cathie Wood purchased 239,083 shares of CoreWeave through her Ark funds, worth about $19.2 million. CoreWeave is an AI infrastructure company that is not yet profitable, and its stock has fallen more than 40% from its peak in May. Despite the drop, Wood believes AI will drive major economic growth. CoreWeave guided for third quarter revenue of $3.4 billion to $3.6 billion, showing strong growth. Analysts remain divided on the stock, with some maintaining bullish outlooks.
Fund Managers Grapple With AI Investing Risks
Fund managers are now asking unusual questions about extreme risks tied to AI and technology. Instead of focusing only on interest rates and cash allocations, investors consider scenarios involving political actions and tech leaders. The article highlights how AI is reshaping the way investment professionals think about market risk. It reflects growing uncertainty in the financial world about where to position money amid rapid AI changes.
Harvard Professors Say AI Hurts Teaching Quality
A survey of 161 Harvard professors found that 64% said AI negatively affected their teaching, up from 42% in 2022. Only 22% believed AI had a positive impact on teaching, down from 34% in 2022. About 71% of respondents said AI harmed their ability to teach, compared with 55% in 2022. The report authors expressed concern that AI is changing higher education in harmful ways. The survey results were published by the Harvard Crimson.
CrowdStrike Named Forrester Leader in AI Security
CrowdStrike was named a Leader in The Forrester Wave Q3 2026 report for external threat intelligence services. The company highlighted its Threat AI technology as key to next generation security operations. CrowdStrike also announced new integrations with Salt Security, Horizon3, and Nord Security to expand its AI driven platform. The recognition supports the idea that its Falcon system can serve as a control layer for complex security operations. Analysts note that future growth will depend on whether momentum leads to improved revenue and margins.
IREN may be undervalued after AI deals and Nvidia partnership
IREN is gaining attention for its Nvidia partnership, Mirantis acquisition, and new AI cloud contracts. The company plans to stop lower margin Bitcoin mining to focus on AI. Its share price recently rose 7.36% in one day to US$46.68 after falling 22.15% over 90 days. Some analysts believe IREN could still be 35% undervalued despite its big AI re-rating.
Sources
- Zero-click RCE vulnerability hit four major AI coding agents, two remain unpatched
- Plugin4Shell Bypasses SHA Pinning Across All Four Major AI Coding Agents
- Europe’s AI firms, playing catch-up, challenge US calls for slowdown
- Ten days that changed the course of AI
- Traders Wary Of Rising AI Risks: Market Snapshot
- The Second AI Election: Testing the Safeguards Before November
- Cathie Wood buys $19.2 million of tumbling AI stock
- AI investing: How should fund managers position for the robot apocalypse?
- Two-Thirds of Harvard Professors Say AI Is Hurting Their Courses
- CrowdStrike (CRWD) Lands Forrester Leadership Nod As AI Security Ties Deepen
- IREN (IREN) Could Be 35% Undervalued After AI Contract Wins And Nvidia Tie Up
Comments
Please log in to post a comment.