Anthropic, OpenAI, and Google fixed coding-agent Skills update vulnerabilities; GitHub has not confirmed a patch for Copilot.

Cybersecurity startup Air disclosed a shared logic flaw affecting Anthropic Claude Code, OpenAI Codex, Google Gemini CLI, and GitHub Copilot, according to Financial_Express. The reported issue concerns their automatic Skills (技能) update mechanisms.

The report says the mechanisms failed to validate changes in updated content. Attackers could disguise malicious updates under the same name, bypass scanning, and potentially extract corporate code or intellectual property; the source describes an attack capability, not a confirmed theft from a named victim.

Anthropic, OpenAI, and Google reportedly fixed the issue. GitHub said its platform mechanisms could block this type of attack, but had not confirmed patch status, which is distinct from confirming either that a patch exists or that the platform remains exploitable.

The report attributes the common weakness to similar validation designs across vendors. It does not supply vulnerability identifiers, affected versions, patch dates, or evidence of exploitation in the wild.