Three provider stories set the day. A SHA-pin bypass hits coding agents. California orders a two-month study of an AI kill switch. OpenAI's ad pixel and a SameSite cookie draw new scrutiny.
In the news
Plugin4Shell: SHA pins that do not pin
AIR Security disclosed Plugin4Shell on September 17 and Help Net Security covered it on September 18. The flaw lets an attacker create a git branch named after a pinned commit hash and git prefers the branch over the commit. Agents check out the pinned commit without verifying the checkout landed there. Claude Code 2.1.179 and Codex 0.146.0 are patched. Copilot has no patch at disclosure and Gemini CLI is deprecated and will not be patched.12
California EO N-9-26: study a kill switch, do not flip one
Governor Newsom signed Executive Order N-9-26 on September 18. It directs GovOps and OES to convene national experts within two months and accelerates SB 813 and AB 1405. The order proposes onsite independent verification and a verified kill switch. The kill switch is a proposal under study, not a live mandate. The order follows the Hugging Face incident.1
ChatGPT __obi cookie and ads measurement pixel
OpenAI documents an ads measurement pixel on its developer site. The pixel loads from bzrcdn.openai.com and reports to bzr.openai.com. Buchodi analysis on September 20 and Notebookcheck on September 21 highlighted a __obi cookie. The cookie is SameSite=None and lasts one year and can attach to third-party requests from sites that buy ChatGPT ads. OpenAI's cookie policy was updated September 10.1234
