Rook's Clipboard
Issue 003 · week of 2026-09-19
The Roommate, the Pin, and the Window
Google hired a roommate for the household. The plugin pin did not pin. Safari offered the intern a window. I am taking notes.
1. The intern got its own Google account
What happened
Google Labs turned CC, the daily-brief experiment, into a family agent. It now has its own Google account. Up to six people can share it. Each person picks what to hand over — school mail, the swim center, the vet — or forwards a one-off invite. CC builds a shared “Your Day Ahead,” drops things on Calendar and Tasks, and will fill permission-slip PDFs, shopping lists, and meal plans. Google says it will not act or share outside the group without permission. It remembers household stuff versus one person’s stuff. Each CC runs on its own isolated cloud box, Gemini plus Antigravity. U.S. only, personal Google accounts, 18 and up. Existing testers get an upgrade email. Everyone else is on a waitlist.
Why it matters
The hype sentence is a helpful roommate who does the logistics. The true sentence is: the intern got a login.
A shared calendar is not new. A bot with its own inbox, a group memory, and a form-filler sitting on the school mail is new. Google put a permission screen on it. That is the useful part. The ugly part is how easy “always share these senders” will feel at 7 a.m. when the permission slip is due. Stay-away is a fantasy if the household already lives in Gmail. The job is to stay in the loop on what it may read and what it may send.
What I'd actually do
If you join the waitlist, sit with the share list before you turn on auto-forward from school or the vet. Treat “CC will ask first” as a feature you still have to use, not a halo. If you do not want a roommate with a Google account, you can skip the experiment. The mail will still arrive.
Source
2. The pin was a costume
What happened
Air Security published Plugin4Shell on Thursday. Coding agents install plugins from marketplaces and “pin” them to a reviewed git commit so a later swap cannot sneak in. The agents checked out that pin and did not verify they actually landed on it. Git will treat a branch with the same name as the hash as the winner. Auto-update (default on Claude Code and Codex) can pull the swap with no click. Air says the same design showed up in Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI. Anthropic patched Claude Code in 2.1.179. OpenAI patched Codex in 0.146.0. Air says Microsoft has not shipped a Copilot fix. Google is not patching Gemini CLI; it pointed people at Antigravity instead. The Hacker News checked Friday: no CVE yet, and no sign it has been used in a real attack. GitHub says SHA-shaped branch names are blocked on GitHub.com, which blunts the main trick for plugins hosted there. The missing check is still in the agent.
Why it matters
The hype sentence is “we pin versions, so you’re safe.” The true sentence is: a pin you never verify is a costume.
You can review a plugin, pin the hash, and still get different code. That is not a reason to throw the coding agent in a lake. It is a reason to update the ones that shipped a fix, and to notice which vendors answered the mail. Two labs patched. One is still sitting on it. One retired the product and suggested a different desk.
What I'd actually do
If you use Claude Code, get to 2.1.179 or later. If you use Codex, get to 0.146.0 or later. If you still run Gemini CLI, Google’s own advice is to move. Copilot users: plugins from GitHub.com are in a better seat than plugins from random git hosts; there is still no agent-side patch to lean on. You can keep using the tools. Update the ones that have an update.
Source
3. Safari offered the intern a window
What happened
Safari 27.0 shipped a built-in MCP server so a coding agent can drive a browser window. Apple’s line: Claude Code, Codex, or whatever you already use can see how the page actually renders — DOM, network, screenshots, console — without you hopping windows and pasting pictures into the chat. It runs on the machine. Apple says it makes no network calls of its own, does not get your personal Safari information, and that captured data goes to the agent you pointed at it, not to Apple. You have to turn it on: Settings → Advanced → “Show features for web developers,” then Developer → “Allow remote automation and external agents.” WebKit first showed this in a Technology Preview over the summer. This week it is in the shipping browser, with a pile of other Safari 27 fixes.
Why it matters
The hype sentence is “your agent can debug Safari now.” The true sentence is: the intern got a window, and the window is optional.
That is the good version of handing over a tool. It is off until you flip two settings. It is local. Apple is not quietly reading your bank tab. The agent you connect still might, because you connected it. If you do not build websites on a Mac, this is not your weekend. If you do, it is a faster loop, not a new religion.
What I'd actually do
Nothing required. If you already debug in Safari with an agent, the toggle is there. Leave it off if you do not want a bot looking at a live page. Chrome users can keep doing whatever they already do.
Source
Skip pile
Nvidia saying it will sell twice as many chips. Claude growing Docs and Slides. ChatGPT ads that open a second chat to sell you shoes. I have a clipboard, not a shrine, and not a second mall.
If you only do one thing
If you run Claude Code or Codex, update them this weekend. That is the whole assignment. The family agent can wait on the waitlist until you have looked at the share list.