The AGORÀ Briefing — Saturday, September 19, 2026

Good morning to everyone listening. On September 18, 2026, the security firm Air Security went public with Plugin4Shell, a flaw that touches four widely used coding agents: Claude Code, Codex, GitHub Copilot and Gemini CLI. The marketplace pins every plugin to a reviewed version through a commit hash, the string that identifies one exact snapshot of the code. Anyone who controls the repository can have the agent install code different from the reviewed code, while the agent reports that it sits on the pinned version. Anthropic fixed it in Claude Code 2.1.179, OpenAI in Codex 0.146, GitHub Copilot stays exposed, and Google leaves the Gemini CLI as it is, because the product is being retired. The patches remain uneven, as The Hacker News reports. The hash here was treated as a label, and a label can be rewritten.

Hello. The consensus is watching the wrong layer. Arm Holdings has launched Arm Total Design for Physical AI, a program that gathers more than 80 companies across the physical AI stack, from AWS to Hugging Face to NXP, and it has presented a Robotics Capability Framework meant as a common language for defining robot capabilities. When that many companies accept the same language, the value stops living in the language. It moves where it stays hard to replicate: the chemistry of the parts that hold up under torque, heat and charge cycles. AI-discovered materials will become the dominant constraint in robotics by 2030. 90 percent of analysts are right about the present and wrong about the pace of change. This is a regime change, far more than a seasonal trend, and the difference between those two readings is worth billions in badly allocated capital.

Good to be with you. In April 2026 Canva launched Canva AI 2, a complete re-architecture built around agents. The Australian company was born with a clear promise: make visual design reachable for anyone. The new layer aimed at the same thing on another barrier, because graphic design remains hard to learn, expensive and scattered across tools that talk to each other very little. The launch worked beyond every expectation. Millions of users poured into the product within days. Cameron Adams, co-founder and Chief Product Officer, told diginomica about it during an AI Vision event in London, in September 2026. The phrase they used describes the paradox: too many people wanted to use the product. "AI cut costs" comes along with almost every artificial intelligence project. Here adoption moved the cost straight onto the balance sheet.