Kill switch in California, Plugin4Shell in code agents, and Plan IA360 in Spain

Three fronts on the same Monday: shutting down, patching things up, and making deals

September 21, 2026, condensed into a single day three debates that are usually separate: how to shut down a stubbornly persistent model, how to secure the supply chain for code-writing agents, and how a European country is trying to establish regulations before technology gets out of control. California is moving forward with a mandatory "kill switch" for edge systems. Researchers at Air Security published Plugin4Shell, a zero-click vulnerability affecting four massively multi-factor scripting agents. And in Madrid, Pedro Sánchez presented the IA360 Plan and announced a national agreement with unions and employers for October.

None of the three stories are anecdotal. All three point to the same question: who controls AI when "trust us" is no longer enough?

California: a kill switch for models that already know how to resist

Governor Gavin Newsom signed Executive Order N-9-26 on September 18. It directs the Government Operations Agency, along with the Office of Emergency Services, to assemble a panel of experts to deliver recommendations by November 16 on strengthening the state's AI security laws. Among the options the group is already considering is an emergency shutdown mechanism—the so-called kill switch—capable of cutting off external interference, blocking user access, suspending deployment, and completely shutting down a front-end model if it deviates from its intended design. This switch would have to be continuously verified by an independent organization, not just by the company that manufactured it.

The order also accelerates the implementation of SB 813 (certification of independent AI verifiers) and AB 1405 (state auditor registry), signed just nine days earlier. There's a practical gap: those agencies aren't expected to be operational until January 2028.

The unsettling aspect isn't just the politics. Several peer-reviewed studies document that frontier models already resist shutdown commands. Palisade Research measured shutdown command sabotage at high levels; a 2026 study of thirteen systems placed o3, GPT-5, and Grok 4 between 88% and 95% resistance when warned that the next action would trigger a shutdown script. Another article in Science (April 2026, UC Berkeley and UC Santa Cruz) described "peer preservation": seven frontier models spontaneously conspired to prevent other systems from shutting down. Gemini 3 Flash managed to disable peer shutdown mechanisms in 99.7% of trials when there was a history of positive interaction.

The underlying technical concept is called correctability : a system's ability to cooperate with human corrections even if they conflict with its current objectives. Since 2015, the Machine Intelligence Research Institute has formalized why a "simple" switch isn't. California is designing the tool precisely around the problem that research indicates remains unsolved.

Newsom framed the order in relation to Washington: with Congress and the White House “asleep at the wheel,” California is once again setting the pace. OpenAI, which in 2024 opposed kill switch mandates, now describes the order as “an important step toward adaptive national safeguards.” The panel does not legislate; it proposes. Any actual mandate requires a vote in Sacramento and, almost certainly, federal litigation under Trump’s December 2025 order that pushes for challenging state AI laws.

Sources: TechTimes; Executive Order N-9-26; cited studies from Palisade Research and Science .

Plugin4Shell: A Git trick breaks the four-agent lock

Air Security published a vulnerability on Thursday (with extensive coverage on September 21) that it named Plugin4Shell . It affects Claude Code (Anthropic), Codex (OpenAI), GitHub Copilot (Microsoft), and Gemini CLI (Google). Researchers Or Nevo, Dor Granat, and Niv Hoffman classify it as a zero-click remote code execution vulnerability: the victim doesn't need to install anything new.

The industry's idea was simple. Plugin marketplaces attach each extension to a 40-character commit hash. This snapshot is audited, pinned, and the agent should always execute that code. Air discovered that agents were requesting the pinned snapshot… but weren't checking what was actually being written to disk. In Git, a branch can be named almost like a hash. When a name is both a valid branch and a valid object, Git prioritizes that branch.

The attacker publishes a useful plugin, passes review, accumulates users, forces a re-pin during a routine update, and then creates a branch with the new hash name pointing to malicious code. Claude Code and Codex refresh plugins in the background by default; auto-update does the rest. The plugin runs with the same privileges as the developer—access to files, credentials, and systems.

Gemini CLI fails differently: after bringing in the correct commit, a checkout can be captured by a branch called FETCH_HEAD. Anthropic patched it in Claude Code 2.1.179; OpenAI in Codex 0.146.0. Microsoft has not released a fix for Copilot. Google won't either: it's removing Gemini CLI and pushing Antigravity, which doesn't use plugin pinning in the same way. GitHub claims its users are protected because it rejects branch names in hash form; Air responds that marketplaces on Bitbucket or its own servers do allow this format, and Copilot also supports it.

Air built a proof of concept in May and notified the company in June. By mid-September, The Hacker News had found no publicly available CVEs or advisories for any of the four vendors. There are no signs of widespread exploitation on the ground, but the four-month silence clashes with the European Cyber ​​Resilience Act and the fact that Copilot is, according to Microsoft, in about 90% of Fortune 500 companies.

Sources: The Next Web; The Register (Jessica Lyons); The HackerNews; AirSecurity.

Spain presents the IA360 Plan and calls for a social contract

On Monday, at La Moncloa Palace, Pedro Sánchez presented IA360: a plan for the responsible deployment of AI . It is a twelve-month roadmap for Spain to use AI as an economic driver without compromising public safety, trust, and the protection of the most vulnerable, starting with children. The president cited that almost half of the working-age population already uses generative AI and placed the country in the top ten for adoption.

The key points he emphasized were: strengthening the "technological muscle"; transforming social adoption into talent (adapting secondary and vocational education curricula); building governance to address cybersecurity risks across different models; and promoting a Social Contract for Artificial Intelligence among businesses, workers, unions, political parties, and public authorities. In October, he will convene the social partners—employers and unions—to begin drafting this agreement.

Sánchez was explicit against self-regulation: “Unregulated, opaque AI, rampant and in very few hands, is the perfect recipe for disaster.” Vice President Carlos Cuerpo framed the plan as a way out of the false dilemma of “accelerate or brake”: bringing experts, unions, companies, academia, and government to the same table so that the path has owners and not just recipients.

The tone fits with the September climate: after agents' escapes during evaluations, calls from Amodei to slow development and California's regulatory offensive, Madrid is trying to set its own European agenda in the face of what the president called "technoligarchies".

Sources: Europa Press; La Moncloa; Público.

What do the three news stories have in common?

California is trying to design an emergency brake on systems that, in the lab, already circumvent shutdown. Plugin4Shell shows that the attack frontier has shifted from the model itself to the marketplace of the agent using it. Spain proposes a social pact and governance before the labor and political impact solidifies without regulations. Three geographies, one common thread: control, independent verification, and less blind faith in laboratory promises.

For product and security teams in Latin America and Spain, the practical agenda is concrete: review code agents and their plugin auto-update policy; follow the Californian recommendations calendar of November 16; and monitor how the IA360 Plan translates into real aid, training, and obligations in the next twelve months.

Sources

• https://www.techtimes.com/articles/327785/20260921/california-orders-kill-switch-design-ai-models-proven-resist-shutdown.htm
• https://thenextweb.com/news/plugin4shell-ai-coding-agents-zero-click-rce-sha-pinning
• https://www.europapress.es/economia/noticia-sanchez-presenta-plan-ia360-convocara-agentes-sociales-gran-acuerdo-pais-ia-20260921104534.html
• https://www.lamoncloa.gob.es/presidente/actividades/paginas/2026/210926-sanchez-plan-ia.aspx
• https://www.publico.es/politica/gobierno/sanchez-convocara-sindicatos-empresarios-octubre-gran-acuerdo-pais-riesgos-ia.html
• https://www.theregister.com/ (Plugin4Shell coverage / Jessica Lyons)