$ cat ai-agents/week/2026-10-05.log
the week in review · Oct 5 – Oct 11, 2026
Claude Code plugin SHA pin bypass allows attacker code
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
Two Claude Code advisories land the same week, plus releases from Gemini CLI, Goose, OpenCode, and Codex.
Plugin Commit SHA Pin Bypass Allows Installation of Attacker-Controlled Code anthropics/claude-code
Pinning a plugin to a commit SHA is supposed to be the guarantee that you get reviewed code. It doesn't hold: the pin can be bypassed so an install pulls attacker-controlled code instead. Treat any plugin install that resolves through the pin path as untrusted until you re-verify what landed.
Arbitrary File Write via Write-Time Symlink Following (TOCTOU) in Claude Code anthropics/claude-code
A write-time symlink race in Claude Code lets a file write land outside the intended path. On shared or multi-user machines, anything writing into a directory another process can swap a symlink in is the exposure, so keep Claude Code's writes confined to directories you alone control.
v2.1.296 anthropics/claude-code
The Claude apps gateway's managed.policies[] gains a code key carrying the same settings as cli, also applied in Claude Desktop's Code tab; set beside desktop, it turns on Claude Desktop's gateway mode. Operators with enterprise policy files now have one place to enforce CLI and Desktop Code settings.
v2.1.292 anthropics/claude-code
claude plugin install takes a --marketplace <source> argument, adding the marketplace if needed under the same policy checks as claude plugin marketplace add and installing from it. The Agent tool also gains an effort parameter, so sub-agents can run at a chosen effort level.
v1.19.0 anomalyco/opencode
OpenCode 1.19.0 stops installing updates automatically and adds an opencode upgrade --major path to OpenCode 2. Add /update in the TUI when you want updates on your own schedule, and the OpenAI ultrafast service tier is now allowed.
Release v0.63.0 google-gemini/gemini-cli
v0.63.0 of gemini-cli leads with a CLI fix that displays a retry progress indicator during connection recovery, so a stalled reconnect no longer looks like a hang. The release also carries the usual preview changelog rollups and auth retry work from the prior days.
v1.54.0 aaif-goose/goose
Goose 1.54.0 prompts for a goose mode during first-time configure and exports sessions to HTML with an interactive viewer, alongside adaptive thinking fixes for Claude Sonnet and Haiku 5.5. If you are still running on defaults, the new prompt is where you pick your mode during setup.
Make apply_patch preserve line endings unconditionally openai/codex
apply_patch now preserves a file's existing line endings without an opt-in, so updating a CRLF file no longer normalizes it to LF. Teams with Windows checkouts can stop passing the preservation flag.
$ ls ai-agents/week/ # the briefings behind this review
Keep up with Agentic Coding in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.