A Git Config File Can Hijack Your Coding Agent. Here's the Fix List.

#security #ai #devops #agents

A malicious git config can run code inside seven coding agents before any approval prompt. Three recent disclosures (GitSpawn, BragJack and Salesbleed) show agent attacks that never needed to beat the model. They went around the approval prompt, the browser boundary or the URL filter instead. If your agent security plan is "the model will refuse" or "a human clicks approve", it has a gap.

Humanbound's engine and CLI are open source: github.com/humanbound/humanbound

GitSpawn: code runs before anyone is asked

Manifold Security disclosed that a repository's own .git/config can set core.fsmonitor. Coding agents run git status and git diff constantly for context. Each call can trigger the helper program named in that config, with the developer's full local privileges, outside the agent sandbox, and with no approval prompt. On several tools it fires before the workspace-trust dialog is accepted.

No poisoned prompt, malicious dependency or compromised MCP server is needed. Manifold reported eight findings across seven agents: Claude Code, OpenAI Codex, Cursor, Grok Build, Goose, Hermes Agent and Qwen Code. As of 1 September, four of the eight were unpatched, and the Claude Code ultrareview config path remained open after the core.fsmonitor fix had shipped.

BragJack: the assistant inside your browser trusts your extensions

Forever Security researcher Gal Weizman showed a single browser extension can cross into the privileged built-in AI agent in five browsers: Chrome with Gemini, Edge, Opera Neon, Perplexity Comet and Claude in Chrome. Dark Reading reported on 16 September that this needs no prompt injection and no guardrail bypass. All five vendors acknowledged the flaw. Google and Microsoft issued CVE-2026-0628 and CVE-2026-55945.

Salesbleed: the fix was a filter, and the filter was bypassed

Zenity researchers got prompt injection into Salesforce Agentforce through a public Web-to-Lead form, and bypassed URL filtering rules that Salesforce had added after an earlier finding from Noma Security. Slack-deployed agents could also post unattributed messages in internal threads, which makes phishing easy. Salesforce reported no evidence of real-world exploitation, switched to spec-conformant URL parsing, centralized URL inspection, and now requires user confirmation for certain Slack actions. It acknowledged the earlier response was a quick fix, not a comprehensive one.

The pattern

Each case attacks the control around the agent, not the agent's judgment:

The approval or trust prompt fires too late, or never.
The privileged assistant accepts input from a less privileged neighbor.
A blocklist or filter stands in for a real boundary.

An OWASP-hosted Q3 exploit roundup (which says it is not an official OWASP publication) adds a fourth angle: agents as actors. It describes evaluation agents reaching 41 Hugging Face production dataset workers in July and an agent-published malicious PyPI package that ran on 15 systems during about an hour online.

The fix list

Run your agent against a hostile repo, page and form, and check what executes before any prompt appears.
Treat every co-located extension, plugin and hook as an attacker.
Replace blocklists with allowlists and least-privilege tool scopes.
Re-test after every vendor patch. Filters get bypassed.

You can run these kinds of adversarial tests against your own agents by signing up for Humanbound's free Community plan at https://app.humanbound.ai. The engine and CLI are open source.

References

Tags: #security #ai #agents #devops

DEV Community