What happened
NVD published 2026-09-30 noting Rider's AI Assistant could auto-update third-party skills without user confirmation; fixed in 2026.2.1.
Why it matters
Auto-updating agent 'skills' without confirmation is a silent supply-chain vector into a developer's IDE AI assistant — code-generation behaviour can be altered to subtly introduce malicious outputs or exfiltrate context.
Attack vector
Third-party AI skills are auto-updated without confirmation, so a skill provider (or a compromised/typosquatted skill source) can change what the coding assistant executes/relies on without the user noticing.
Affected systems
JetBrains Rider before 2026.2.1 (AI Assistant)
Mitigation
Update JetBrains Rider to 2026.2.1 or later.