The Plugin You Approved Can Change Itself Later. Go Ask Who Watches Yours.

A security firm called AIR put out research Thursday that got written up all over the tech press as a coding story. I've been chewing on it since, and I don't think it's a coding story at all.

Here's what happened. Four of the big AI coding tools, Anthropic's Claude Code, OpenAI's Codex, GitHub Copilot, and Google's Gemini CLI, all turned out to have the same hole in them. These tools let you install add-ons, and there's a lock built in that's supposed to freeze an add-on at one exact version of its code. You review that version, you approve it, and from then on it can't turn into something else without you knowing. That's the whole promise. The researchers found a way to slip different code in behind the lock while the lock still reads as intact.

The bad part is that nobody has to click anything. Two of those tools quietly refresh their add-ons in the background by default, so the swapped code lands on machines belonging to people who did everything right and then went to lunch. The researchers said it plainly, that the victim only has to have a plugin installed, from a marketplace they trust, reviewed and locked down exactly the way the system intends.

The companies split on what to do about it. Anthropic patched Claude Code. OpenAI patched Codex. Microsoft was told about the same flaw in Copilot and hasn't shipped a fix. Google went the other direction and decided not to patch Gemini CLI at all, they're retiring it and pointing people at a newer tool, which means every copy still sitting on somebody's machine stays open with no end date on it.

Why I'm writing this for people who don't write code

Almost nobody reading this runs Claude Code. I know that. But stay with me for a second, because the mechanism underneath is already sitting in your business.

Your website runs on plugins. If it's WordPress it's probably running a dozen of them right now. The booking plugin, the contact form, the SEO one, that AI chat widget somebody bolted on last spring. Your Google account has apps connected to it. So does your Facebook page, and your point of sale, and whatever you use for email marketing.

Every one of those got approved exactly once. By you, or by a web guy four years ago, or by your nephew who built the site as a favor and hasn't looked at it since. And then they all kept updating themselves quietly on a schedule nobody set and nobody watches.

That's the overlap. Not the bug itself, the habit. We treat approval like it's permanent when it's really just a snapshot of one afternoon.

What I'd actually do this week

Pull up the plugin list on your website and count them. That's it, just count. Most owners I sit down with genuinely don't know the number, and when we look there's always a few nobody has touched since 2021.

An abandoned plugin is worse than an old one. When the original person walks away, somebody else can take over that project and push code out to everybody who has it installed, and it arrives looking like a normal update. The same researchers found 925 add-ons that had already been handed off that way, reaching around 134,000 machines. Anything on your list where the last update was years ago is a candidate for that, and it should either come off or get a real owner.

Then go read your Google account's connected apps page, and the business integrations list on your Facebook page. Ten minutes each. You'll find something you don't recognize. Everybody does. I did it on my own accounts in July and pulled off two things I had no memory of ever approving.

None of this means stop installing stuff. I run plenty of it and it's a real edge for a small shop. It means somebody in your building should own the list and look at it a couple times a year, and right now in most businesses I walk into that person doesn't exist.