Anthropic, OpenAI and Google fix coding-agent Skills update flaws; GitHub has not confirmed a Copilot patch

Sep 17, 2026 · Issue 7 · 3 sources, 3 articles

Anthropic, OpenAI and Google have fixed vulnerabilities in the Skills update mechanism of their coding agents, but GitHub has not confirmed a fix for Copilot. Hungarian outlet Prog.hu also reported on the severe flaw affecting Claude, Codex and Copilot.

Who is affected and how

senior developer

Updating Claude Code and Codex clients is urgent, and Skills use in Copilot should be restricted.

CTO

The risk of using Copilot must be managed until GitHub confirms a fix.

Narrative: The coding agent is the new attack surface

Sources

• Anthropic, OpenAI, and Google fixed coding-agent Skills update vulnerabilities; GitHub has not confirmed a patch for Copilotcomputelabs.ai · Sep 17, 2026
• GitHub Copilot: GitHub's Agent Harness Explainedinnfactory.ai · Sep 20, 2026
• Extremely serious vulnerability found in Claude, Codex and Copilot tooprog.hu · Sep 18, 2026 · magyar

Machine-generated summary based on the titles and excerpts of the source articles. The facts come from the linked article.