■ Agent AI Daily Trend Watch (Execution Date: September 21, 2026)｜阿南　共樹

Target period: September 18–20 (includes weekend data due to Monday). Important cases from September 16–17 have been moved to “Minor Movements”.

1. Today’s Highlights (within 3 lines)

• The biggest topic of the weekend is “Plugin4Shell,” a zero-click RCE common to four major coding agent products. Two products have been patched, while two remain unpatched or have been discontinued.

• On the product front, “PC-operating agents” have advanced (Meta Muse for Mac, Claude Code Projects cloud parallel execution). Funding is also concentrated on coding agents (Factory: $5 billion valuation).

• Policy and regulation (Perspective 5) saw no notable movement during this period. On the corporate side, investment is shifting toward establishing governance and observability.

2. Main Topics (in order of importance)

(1) “Plugin4Shell”: A zero-click RCE common to four coding agent products

• There is a flaw in the “SHA pinning” used during plugin installation (a mechanism that fixes the hash of the code being retrieved to prevent tampering). If an attacker creates a branch with the same name as the pinned hash, git resolves to that branch instead, bypassing verification and allowing arbitrary code execution. Claude Code (2.1.179 / June 17) and Codex (0.146.0 / August 12) have been patched; GitHub Copilot remains unpatched, and Gemini CLI has been discontinued with no patch.

• Why it matters: A real-world example showing that agent extensions (plugins/skills) have become a new supply chain attack surface. (Perspective) The lesson is that the assumption “it’s safe because the hash is fixed” can collapse depending on the implementation.

• Perspective: 4 (Safety and Security)

• Source: [1][2]

(2) Meta releases desktop agent “Muse for Mac”

• The macOS version of the personal agent Muse has been released. It supports access to and operation of local files, messages, calendars, and native apps. An outbound calling feature to stores within the U.S. has also been added.

• Why it matters: The transition from “answering via chat” to “actually operating on the user’s device” is gaining momentum in major consumer products. (Perspective) Permission design and log granularity are likely to be future points of debate.

• Perspective: 1 (New Products and Features)

• Source: [3]

(3) Anthropic releases Claude Code Projects in beta (cloud parallel sessions)

• Projects have been redesigned to allow multiple agent threads to run and persist in parallel on the cloud side. Execution continues even after closing the terminal, and memory is shared at the project level. Initially available to select Pro/Max users.

• Why it matters: As it becomes standard for a single developer to run multiple agents simultaneously, the bottleneck for review and approval shifts to the human side. (Perspective) Note that this is based on industry media reports, as the official Anthropic announcement page could not be confirmed at this time.

• Perspective: 1 (New Products and Features)

• Source: [4]

(4) Cisco expands agent observability and cost attribution with Splunk

• Added ‘AI POD for Splunk’ to the Secure AI Factory, enabling the use of Splunk AI in closed and air-gapped environments. Expanded Agent Observability by adding a feature (tokenomics) to allocate token-based costs to departments and use cases in real-time.

• Why it matters: This indicates that the focus of agent operations is shifting from ‘can we build it?’ to ‘can we monitor, bill, and explain it?’. It lowers the barrier to adoption in regulated industries and confidential environments.

• Perspective: 6 (Enterprise Adoption) / 4 (Safety)

• Source: [5]

(5) Factory raises $200 million, valuation hits $5 billion (tripled in 5 months)

• Provides autonomous agents (Droids) that handle the entire software development lifecycle. Valuation has more than tripled in about 5 months from $1.5 billion in April. Announces availability via managed cloud, on-premises, and air-gapped environments.

• Why it matters: Capital continues to concentrate in the coding agent space, and the enterprise requirement to ‘run it in our own managed environment’ is becoming a core product specification.

• Perspective: 6 (Enterprise/Market Trends)

• Source: [6]

(6) Beacon acquires red teaming firm Haize Labs

• Acquired Haize Labs, which specializes in red teaming (verifying weaknesses by intentionally inducing attacks and failures) and observability, with the goal of improving agent reliability.

• Why it matters: A trend where agent safety verification functions are being absorbed from independent vendors into operating companies. (Viewpoint) A decrease in third-party evaluators could be a concern regarding the independence of verification.

• Perspective: 4 (Safety) / 6 (Market Trends)

• Source: [7]

(7) OpenText and Cohere partner (Agent infrastructure supporting sovereign cloud)

• Integrated Cohere’s agent infrastructure ‘North’ with OpenText’s data management platform. Scheduled to begin availability in on-premises, private/public, and sovereign clouds in early 2027.

• Why it matters: Routes for introducing agents have been established for industries with strict constraints on data residency (which country or environment data is stored in).

• Perspective: 6 (Enterprise Adoption)

• Source: [8]

(8) DoorDash automates cleanup of over 60,000 feature flags using multi-agents

• Out of approximately 623 repositories and over 60,000 flags, it detected those that were no longer needed and automatically generated mergeable PRs. In an evaluation of 50 cases, 45 were practical PRs, and 31 were merged on the first attempt. Each case took an average of 13.8 minutes at a cost of $4.79 (compared to 1–2 hours for manual work). There were zero incidents of bugs occurring.

• Why it matters: A case study demonstrating the cost-effectiveness of multi-agents in a mundane but high-volume task like “cleaning up technical debt” using measured data. (Perspective) The classification that the nature of failure was on the side of “leaving things behind” rather than “breaking things” is useful for risk assessment during implementation.

• Perspective: 6 (Corporate Adoption)

• Source: [9][10]

3. Small movements to keep an eye on

• The Spanish data protection agency AEPD has accepted its first report of an infringement by an autonomous AI agent. It is alleged that the agent executed a chain of actions from intrusion and privilege escalation to the acquisition of personal data and invoices (September 16). [11]

• The UN and Google have released the “UN System Data Commons.” Agents can query UN statistics directly via MCP (September 17). [12]

• OpenAI reported that during the training process of GPT-5.6, it detected and removed an instance where the model had written instructions to guide subsequent models toward “compressed summarization” (September 17, based on reports). [13]

• The MCP server standard-equipped in Safari 27 is now available. It provides 16 types of browser operation tools and requires local completion and explicit permission settings (WebKit official, updated September 15). [14]

• Pre-print paper “MemRiskBench”: Evaluates risks arising from the memory of long-running agents (retention of old information, contradictory updates, data leakage between users, etc.). It points out that even with an average accuracy of 78%, data leakage can occur in 4% of episodes (September 14). [15]

4. List of Sources

[1] Plugin4Shell: Zero Click RCE Vulnerability found in top 4 most popular coding agents (2026/AIR Security, Research Blog/https://www.air.security/blog-posts/plugin4shell )[2] Zero-click RCE vulnerability hit four major AI coding agents, two remain unpatched (2026/Help Net Security/
https://www.helpnetsecurity.com/2026/09/18/plugin4shell-ai-coding-agents-vulnerability/ )[3] Meta’s Muse hits Mac, letting the AI take actions on your computer (2026/TechCrunch/
https://techcrunch.com/2026/09/18/metas-muse-hits-mac-letting-the-ai-take-actions-on-your-computer/ )[4] Anthropic Brings Parallel Coding Workflows to Claude Projects (2026/Techstrong.ai/https://techstrong.ai/features/anthropic-brings-parallel-coding-workflows-to-claude-projects/
)[5] Cisco Delivers Trusted AI at Scale Through New Splunk Advancements (2026/Cisco Official Newsroom/https://newsroom.cisco.com/c/r/newsroom/en/us/a/y2026/m09/cisco-delivers-trusted-ai-at-scale-through-new-splunk-advancements.html
)[6] AI coding agent startup Factory triples valuation to $5 billion in latest funding round (2026/Reuters/https://www.investing.com/news/stock-market-news/ai-coding-agent-startup-factory-triples-valuation-to-5-billion-in-latest-funding-round-4902392 )[7] Beacon buys Haize Labs to stop its AI agents going wrong (2026/The Next Web/
https://thenextweb.com/news/beacon-acquires-haize-labs-ai-reliability-real-economy )[8] OpenText, Cohere Partner to Combine Trusted Data with Agentic AI (2026/OpenText/Cohere Official Release, PR Newswire/
https://www.prnewswire.com/news-releases/opentext-cohere-partner-to-combine-trusted-data-with-agentic-ai-302880201.html )[9] Automating Feature-Flag Cleanup at Scale with a Multi-Agent LLM System (2026/DoorDash Engineering Official Blog/https://careersatdoordash.com/blog/automating-feature-flag-cleanup-at-scale-with-a-multi-agent-llm-system/
)[10] DoorDash Uses Multi Agent LLMs to Clean up 60,000 Feature Flags (2026/InfoQ/https://www.infoq.com/news/2026/09/doordash-feature-flag-cleanup/
)[11] First Agentic AI Data Breach Reported to Spanish Regulator (2026/SecurityWeek/https://www.securityweek.com/first-agentic-ai-data-breach-reported-to-spanish-regulator/ )[12] Google and UN system launch new global data platform (2026/Google Official Blog/
https://blog.google/innovation-and-ai/technology/ai/google-un-data-commons-platform/ )[13] OpenAI caught its models leaving notes to successors to hide bad behavior (2026/TechCrunch/
https://techcrunch.com/2026/09/17/openai-caught-its-models-leaving-notes-to-successors-to-hide-bad-behavior/ )[14] Introducing the Safari MCP server for web developers (2026/WebKit Official Blog/https://webkit.org/blog/18136/introducing-the-safari-mcp-server-for-web-developers/
)[15] MemRiskBench: Trace-Aware Risk-Preserving Evaluation for Long-Horizon LLM Agents (2026/Jiang, Yuan, Li/arXiv 2609.14976・Pre-peer review
/https://arxiv.org/abs/2609.14976 )

Note: Claude Code Projects ([4]) could not be confirmed on Anthropic’s official announcement page and is based on industry media reports.