Live Updates > Live Update Details
2026-09-18 02:03:11
Cybersecurity startup Air has publicly disclosed for the first time that four mainstream AI programming agent products on the market—Anthropic Claude Code, OpenAI Codex, Google Gemini CLI, and GitHub Copilot—exhibit a completely consistent logical security vulnerability: their automatic skill update functions lack verification of content changes. Attackers can masquerade as malicious updates with the same name, bypassing platform security scans and silently stealing internal code or intellectual property. The root cause of this vulnerability lies in the highly similar verification mechanisms designed by these vendors, exposing a common security blind spot in the entire AI programming tool industry. As of now, except for GitHub, the other three vendors have completed vulnerability patches; GitHub stated that its existing mechanisms can intercept such attacks, but did not specify the update status of the relevant patches.
