--- title: AI coding agents get a supply-chain problem of their... description: Plugin4Shell shows that four major AI coding agents can be tricked into running attacker code via Git reference confusion, even with SHA pinning supposedly... canonical: https://daily.dev/posts/ai-coding-agents-get-a-supply-chain-problem-of-their-own-epic-halts-shipping-to-fix-mychart-holes-kztqtaxdb twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: AI coding agents get a supply-chain problem of their own, Epic halts shipping to fix MyChart holes | daily.dev og:description: Plugin4Shell shows that four major AI coding agents can be tricked into running attacker code via Git reference confusion, even with SHA pinning supposedly... og:url: https://daily.dev/posts/ai-coding-agents-get-a-supply-chain-problem-of-their-own-epic-halts-shipping-to-fix-mychart-holes-kztqtaxdb og:image: https://api.daily.dev/og/posts/KzTQtaxDb.png og:image:alt: AI coding agents get a supply-chain problem of their own, Epic halts shipping to fix MyChart holes og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # AI coding agents get a supply-chain problem of their own, Epic halts shipping to fix MyChart holes **[Security Digest](https://daily.dev/sources/security_digest)** · 4 min read · 0 upvotes · 0 comments ## Summary Plugin4Shell shows that four major AI coding agents can be tricked into running attacker code via Git reference confusion, even with SHA pinning supposedly enforced. A second disclosure, ConfigPoisoning, hits a DeepSeek-Reasonix git client through gitattributes-selected filter drivers. Epic paused MyChart development for six weeks after Anthropic's security model found holes that let outsiders read patient records without leaving log traces. PgBouncer finally gets patched after years of neglect, and a new Ubuntu container escape bypasses kernel version checks entirely. ## Content **TLDR:** Plugin4Shell shows that four major AI coding agents can be tricked into running attacker code via Git reference confusion, even with SHA pinning supposedly enforced. A second disclosure, ConfigPoisoning, hits a DeepSeek-Reasonix git client through gitattributes-selected filter drivers. Epic paused MyChart development for six weeks after Anthropic's security model found holes that let outsiders read patient records without leaving log traces. PgBouncer finally gets patched after years of neglect, and a new Ubuntu container escape bypasses kernel version checks entirely. --- ## Plugin4Shell breaks SHA pinning across Claude Code, Codex, Copilot, and Gemini CLI AIR Security found that all four major AI coding agents could be tricked into checking out attacker-controlled plugin code despite SHA pinning appearing to work, via a Git branch name colliding with the expected commit SHA format or a FETCH_HEAD bug in Gemini CLI. Since plugin auto-updates are often on by default, this is a zero-click compromise once a plugin repo is poisoned. Claude Code patched in 2.1.179, Codex in 0.146.0; Copilot had no fix at disclosure, and Google just deprecated Gemini CLI instead of fixing it. The real lesson: these agents verified the requested reference but never checked what commit actually landed in the working tree. [Read more](https://daily.dev/posts/Ob4sENB1p) ## ConfigPoisoning hijacks DeepSeek-Reasonix through a git filter nobody was watching GitLab's Threat Research Group disclosed CVE-2026-102437, which abuses the git filter..clean mechanism selected per-file via .gitattributes rather than a fixed config key, sidestepping DeepSeek-Reasonix Studio's existing hardening of other dangerous git configs. Just viewing a diff triggers the clean filter and runs attacker code. Fixed in Studio 2.21.0 and npm package 1.39.3, but GitLab says the same vulnerability class hits other coding agents under coordinated disclosure, so this probably isn't the last one. [Read more](https://daily.dev/posts/HbICkONlC) ## Epic halts MyChart development after AI-assisted testing finds silent access holes Epic paused most product work for roughly six weeks after Anthropic's Mythos security model was turned loose on its systems and found that some MyChart configurations let outsiders access patient records without leaving any trace in logs. MyChart handles over 320 million patient records across US hospitals. This lands in a year already stacked with healthcare breaches at CareCloud, McKesson, Craneware, and DentaQuest, on top of the 192-million-person Change Healthcare ransomware attack. [Read more](https://daily.dev/posts/99jitbhC4) ## PgBouncer 1.26.0 patches three CVEs, two of them pre-auth CVE-2026-19888 is a NULL pointer dereference in SCRAM parsing that's been sitting there since 2019 and crashes the process with a single malformed attribute, reachable by anyone who can hit the listener over TCP, no auth required. CVE-2026-6668 is worse in a quiet way: an integer overflow that hangs PgBouncer forever instead of crashing it, silently freezing every client since it's single-threaded. The post's real point is that PgBouncer sits outside PostgreSQL's regular upgrade cadence, so almost nobody patches it on a schedule. [Read more](https://daily.dev/posts/RhxrDVMAu) --- ## Also notable - **CVE-2026-80521: Ubuntu container escape that version checks can't catch:** A public exploit for this use-after-free in the Linux AF_UNIX socket garbage collector breaks out of default Docker/Kubernetes containers to root on the host, and because distro kernels backport fixes independently of version numbers, Ubuntu 24.04/26.04 and Debian 12 were still unpatched as of October 2 even though upstream fixed it in 6.12.111. [Read more](https://daily.dev/posts/43SFMS1mb) - **Fortinet FortiMail zero-day under active exploitation, CISA deadline today:** CVE-2026-104286, CVSS 9.8, lets unauthenticated attackers write arbitrary files via path traversal and null-byte handling in the FortiMail web interface, and CISA's KEV deadline for federal agencies to mitigate is October 4, tomorrow. [Read more](https://daily.dev/posts/DKwLG7A1e) - **LiteLLM supply-chain breach exposed 2,500+ orgs through a stolen CI token:** Attackers compromised the Trivy GitHub Action to steal a bot token, force-pushed malicious code, and used that to steal LiteLLM's PyPI publishing token and ship backdoored packages (1.82.7, 1.82.8) that harvested cloud keys, SSH keys, and LLM API keys from an estimated 434,000 CI/CD pipelines. [Read more](https://daily.dev/posts/YsBBrmWZU) - **GitHub's SecurityAdvisory GraphQL API gets CVE and triage fields:** New read-only fields (cveId, sourceCodeLocation, githubReviewedAt, nvdPublishedAt, repositoryAdvisoryUrl) plus severities and isWithdrawn filters let you do severity-based triage entirely through GraphQL without falling back to the REST API. [Read more](https://daily.dev/posts/lQo1bDLM6) - **MariaDB vulnerability reports jump from 16 a quarter to 92:** The MariaDB Foundation attributes the spike directly to AI-assisted security research tools letting researchers tear through its large, mature codebase far faster than before, and says the reports were largely legitimate, not noise, with all confirmed issues fixed across 27 public advisories. [Read more](https://daily.dev/posts/FwI1JhQaI) ## Similar posts on daily.dev - [The Plugin Was Trusted. The Code Wasn’t.](https://daily.dev/posts/the-plugin-was-trusted-the-code-wasn-t--ob4senb1p) · Medium · 0 upvotes · 0 comments - [Security Flaws in Anthropic’s Claude Code Risk Stolen Data, System Takeover](https://daily.dev/posts/security-flaws-in-anthropic-s-claude-code-risk-stolen-data-system-takeover-j81sidgwk) · DevOps.com · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#git](https://daily.dev/tags/git) [View this post on daily.dev](https://daily.dev/posts/ai-coding-agents-get-a-supply-chain-problem-of-their-own-epic-halts-shipping-to-fix-mychart-holes-kztqtaxdb) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/ai-coding-agents-get-a-supply-chain-problem-of-their-own-epic-halts-shipping-to-fix-mychart-holes-kztqtaxdb","headline":"AI coding agents get a supply-chain problem of their own, Epic halts shipping to fix MyChart holes","text":"Plugin4Shell shows that four major AI coding agents can be tricked into running attacker code via Git reference confusion, even with SHA pinning supposedly enforced. A second disclosure, ConfigPoisoning, hits a DeepSeek-Reasonix git client through gitattributes-selected filter drivers. Epic paused MyChart development for six weeks after Anthropic's security model found holes that let outsiders read patient records without leaving log traces. PgBouncer finally gets patched after years of neglect, and a new Ubuntu container escape bypasses kernel version checks entirely.","url":"https://daily.dev/posts/ai-coding-agents-get-a-supply-chain-problem-of-their-own-epic-halts-shipping-to-fix-mychart-holes-kztqtaxdb","datePublished":"2026-10-03T04:17:35.845Z","dateModified":"2026-10-03T04:17:57.863Z","author":{"@type":"Organization","name":"Security Digest","logo":"https://media.daily.dev/image/upload/s--m4ZKB_C0--/f_auto,q_auto/v1779959612/logos/security_digest","url":"https://daily.dev/sources/security_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/security_digest","name":"Security Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Security Digest","item":"https://daily.dev/sources/security_digest"},{"@type":"ListItem","position":3,"name":"AI coding agents get a supply-chain problem of their own, Epic halts shipping to fix MyChart holes"}]} ```