self.md radar — 2026-09-18
the pinned commit that wasn’t there
A plugin installer can display a hash, update in the background, and still land on different code. The report below names the checkout command that causes it; two quieter releases deal with the paperwork around agent claims and the permissions around a running task.
1. Plugin4Shell turns a pinned plugin into a branch
Air Security says four coding agents accepted a plugin checkout that only looked pinned. In its reported attack, the upstream repository supplies a branch whose name is the same 40-character SHA as the reviewed commit. Plain git checkout prefers that ref name; an automatic plugin update can then put the branch’s code on the machine without a new install click.
The repair is embarrassingly literal: after checkout, compare git rev-parse HEAD with the pinned SHA and stop if they differ. Air Security lists Claude Code 2.1.179 and Codex 0.146.0 as patched. Its report says GitHub Copilot had no shipped fix and Gemini CLI, now deprecated, will not get one. The marketplace can inspect a pin; the agent still has to check what it actually ran.
reading: Air Security’s Plugin4Shell disclosure
2. An audit lead can stay unresolved
Cloudflare has released a security-audit skill for coding agents with three end states in findings.json: confirmed, needs_validation, and rejected. That is a small but healthy refusal of the usual model-report trick, where every suspicious string becomes a neat severity label by the final page.
The workflow keeps a coverage-ledger.json, sends each candidate to a fresh agent tasked with disproving it, and runs schema checks again after a material replacement. A blocked lead gets an exact missing fact, not a guessed impact score. The repository also requires an OS-enforced sandbox before it will execute target-controlled builds or fixtures; otherwise the lead remains open.
reading: Cloudflare security-audit skill · Cloudflare’s vulnerability-harness background
3. OpenShell makes a running sandbox say no to POST
NVIDIA’s alpha OpenShell lays out an agent runtime where filesystem and process rules are fixed when the sandbox is created, while network and inference policy can be changed during a task. Its quickstart starts with a GitHub request blocked by the proxy, applies a short YAML rule, then permits a GitHub API GET while refusing a POST to create an issue.
That split is more useful than a broad “sandboxed” badge. An agent may need to read one API now and nothing else; a process restriction is a different kind of promise and cannot be casually loosened later. OpenShell supports Docker, Podman, MicroVMs, and Kubernetes, but its own project-status badge says alpha. The policy work has not disappeared. It has become visible.
reading: NVIDIA OpenShell repository · OpenShell documentation
Related self.md routes
- Personal AI OS tools — the control-plane map for personal agents, receipts, memory, and tools
- AI coding assistants — compare coding workbenches by review surface, permissions, cost, logs, and escape hatches
- Sandboxing and security — give agents useful power without giving them the whole house