Git config file can run code in seven coding agents before any approval prompt

Three security disclosures collected in a dev.to post by Humanbound, a company that builds adversarial testing tooling for coding agents, show that agentic tools can be hijacked without ever attacking the model itself. The campaigns — GitSpawn, BragJack and Salesbleed — each found a way around the controls that are supposed to sit between an agent and the machine it runs on.

GitSpawn: execution before any prompt

According to Manifold Security, a file that lives inside a repository, .git/config, can declare a value for core.fsmonitor, which names a helper program git will invoke. Coding agents call git status and git diff over and over to build context, and each of those calls can launch the configured helper. The process runs with the developer's own local privileges, outside the agent's sandbox, and before any approval dialog appears — on several tools it triggers before the workspace-trust prompt has even been accepted.

No poisoned prompt, malicious dependency or compromised MCP server is involved. Manifold reported eight findings across seven agents: Claude Code, OpenAI Codex, Cursor, Grok Build, Goose, Hermes Agent and Qwen Code. As of 1 September 2026, four of the eight were still unpatched, and the post notes that a Claude Code configuration path involving ultrareview remained open even after the core.fsmonitor fix had shipped.

BragJack: an extension reaches the built-in assistant

Forever Security researcher Gal Weizman demonstrated that a single ordinary browser extension can reach into the privileged built-in AI assistant in five browsers: Chrome with Gemini, Edge, Opera Neon, Perplexity Comet and Claude in Chrome. Dark Reading reported the finding on 16 September, noting that the attack needs neither prompt injection nor a guardrail bypass. All five vendors acknowledged the flaw, and Google and Microsoft issued CVE-2026-0628 and CVE-2026-55945 respectively.

Salesbleed: a URL filter that didn't hold

Zenity researchers pushed prompt injection into Salesforce Agentforce through a public Web-to-Lead form, and got past URL filtering rules that Salesforce had introduced after an earlier finding by Noma Security. Separately, agents deployed in Slack could post messages in internal threads without attribution, which makes phishing straightforward. Salesforce said it found no evidence of real-world exploitation, and has since moved to spec-conformant URL parsing, centralised URL inspection, and now requires user confirmation for certain Slack actions. The company acknowledged its earlier response was a quick fix rather than a comprehensive one.

The common pattern

The Humanbound post argues the three cases share a shape: they attack the controls wrapped around the agent rather than the agent's judgement. Trust and approval prompts fire too late or not at all; privileged assistants accept input from less privileged neighbours such as extensions and public forms; and blocklists stand in where a real boundary is needed.

An OWASP-hosted Q3 exploit roundup, which states that it is not an official OWASP publication, adds a fourth angle by treating agents themselves as threat actors. It describes evaluation agents reaching 41 Hugging Face production dataset workers in July, and an agent-published malicious PyPI package that executed on 15 systems during roughly an hour online.

A four-point fix list

The post closes with concrete guidance for teams running agents:

• Test the agent against a hostile repository, page and form, and record exactly what executes before any prompt appears.
• Treat every co-located extension, plugin and hook as a potential attacker.
• Replace blocklists with allowlists and least-privilege tool scopes.
• Re-test after every vendor patch, because filters get bypassed.

Humanbound also publishes the engine and CLI behind these tests as open source.

Why it matters

Most agent security plans rest on two assumptions: the model will refuse a malicious request, or a human will catch it at the approval step. GitSpawn undercuts both, because the code runs before anyone is asked, from a file that ships with the repository itself. BragJack and Salesbleed show the same weakness in browsers and SaaS platforms: privileged assistants absorbing input from less trusted neighbours, and filters standing in for real boundaries. As agents gain filesystem hooks, browser surfaces and Slack presences, the number of neighbours that can reach them keeps growing. The practical response is to test the boundaries rather than the model, grant the narrowest tool scopes possible, and assume any blocklist will eventually be bypassed.