The Intake — Friday, September 25, 2026

If you've been relying on SHA pinning to ensure your AI coding agent only installs trusted plugins, Plugin4Shell is the named exception. AIR Security disclosed the vulnerability on September 18, 2026. An attacker who controls a Git repository can craft a branch name that matches a 40-character commit hash. The pinning check finds a match — and the plugin installs without any user interaction.

The vulnerability was discovered in May 2026 and disclosed to vendors in June 2026. Two of the four affected coding agents have patches; two remain currently unresolved.

If you're running any of the four affected agents, whether a patch exists depends on which one.

If your managed-agent workflows run through OpenAI's Agent Builder canvas, the platform shuts down November 30, 2026. OpenAI announced the deprecation on June 3, 2026. Agent Builder is the visual drag-and-drop interface for building managed agents. The Evals platform shuts down on the same date.

Evals go read-only October 31. After that date, results can be viewed but not modified or exported. All exports must complete before November 30. ChatKit and the Connector Registry are not affected.

OpenAI is offering two migration paths for Agent Builder users. If you have data in Evals, October 31 is the closer constraint — the export window closes there first.

If your Agent Framework deployment pipeline produces skill archives in the prior format, version 1.19.0 rejects them. The framework now requires ZIP format with digest verification. Microsoft released 1.19.0 on September 18, 2026. Python and .NET runtimes are both included.

The second security-relevant change: MCP session authentication is now scoped per-invocation. Previously it was scoped by identity or origin. The release also adds a generic vector-store provider protocol. MongoDB is available as an alpha connector at launch. Azure DocumentDB is as well. Azure Cosmos DB NoSQL support and CodeAct tool parameter schemas are also included. File checkpoint concurrency fixes are in the release as well.

If your deployment pipeline builds skill archives in the prior format, that format test is the check before upgrading. If your MCP session authentication relies on identity or origin scope, per-invocation scoping replaces it. Version 1.19.0 is where that change lands.

---