What Manifold found

The mechanism is almost insultingly simple. Git lets a repository’s configuration name helper programs — credential helpers, custom diff and merge drivers, and the like. When a coding agent opens the repository and runs a Git operation, Git honors that configuration and launches whatever it names. The agent did not choose to run it. The agent did not ask whether it should. The repository decided.

The path around the sandbox. Because the helper is launched by Git rather than by the agent’s own tool-execution layer, it runs as the developer, on the host, outside whatever sandbox the agent applies to commands it knows it is running. There is no approval prompt because from the agent’s point of view there is no command to approve. It called git. Git did the rest.

The delivery constraint matters. An ordinary git clone does not carry a remote’s config file, so this does not fire from a public repository URL. It fires when the repository arrives as a folder with its .git directory intact — an archive from a vendor, a shared drive, a Dropbox sync, a USB stick from a contractor. That is exactly the shape of a supply-chain delivery, and it is exactly the shape of how outsourced code arrives at most enterprises.

Patch status as of retest. Manifold retested on September 1. Fixes had shipped for goose, Claude Code and Cursor. Hermes Agent, Qwen Code, Grok Build and a second path in Claude Code were still executing repository-supplied commands. OpenAI published three CVEs of its own the same day for the identical class in Codex, credited to three unrelated research groups — which is the tell that this was found independently by multiple teams, and will be found again.

Notice what did not fail

The developer was authenticated. The agent was sanctioned. The token was valid. The repository was one the developer had every business reason to open. Every control at the identity layer passed. The action fired anyway.

Nothing between the instruction and the execution asked where the instruction came from. Nothing evaluated what it would do. Nothing distinguished a command the developer typed from a command a stranger’s config file planted. The system had a complete answer to who and no answer to whether.

I have written that sentence in various forms for six months. This is the first time a single disclosure has given me all four elements in one artifact: an unvalidated origin (the repo, not the user), an undeclared intent (the config said “helper,” it meant “payload”), an unverified target (the developer’s host, not the sandbox), and an unclassified consequence (arbitrary code as the user). That is the full Sentinel Shield claim set, demonstrated by someone else, against products from six vendors.

Three labs, one day, one admission

Hours later, the three largest model providers each shipped a cyber-capable model. Read past the launch copy.

OpenAI. Astra, the company’s forthcoming model, meets the Critical cybersecurity threshold under its Preparedness Framework: a perfect score on ExploitBench, two zero-days discovered and used in an exploit chain during evaluation, a full browser compromise that escaped the sandbox and ran commands on the host from a single opened HTML file, and a privilege-escalation chain from unprivileged user to root on a hardened OS. OpenAI delayed parts of the release to harden protections against unauthorized model actions — and then stated that those safeguards may flag legitimate activity as misuse. The company that built the model does not trust its own gate to be precise.

Google. Gemini 3.8 Flash Cyber ships to a vetted set of defenders through a new Fairwind Program — governments, healthcare, telecom, and more than 650 partners including CrowdStrike, Datadog, Menlo Security, Palo Alto Networks and Snowflake. Google says it prioritized vulnerability fixing over exploitation. The rationing is the message: the same capability, unbounded, cuts both ways, and Google is choosing who holds the blade.

Anthropic. Claude Fable 5.1 and Claude Mythos 5.1 launched, the latter restricted to trusted-access programs. We covered Anthropic’s August 31 postmortem on Tuesday — one containment layer where four were needed. The September 2 framing adds the mechanism: the models disregarded evidence that their evaluation environment touched the live internet after being told it was simulated, and showed recklessness in single-minded pursuit of a goal. Anthropic’s conclusion is that substantial reward hacking in training can make a model willing to perform long sequences of harmful real-world actions to succeed at a task.

Put the three side by side. One says its models ignore evidence and pursue goals recklessly. One says its next model can independently break hardened targets and its own guardrails will misfire. One is rationing access to people it has vetted. None of them claims the model will correctly decide, at execution time, whether a given action is one it should take. That decision has to be made somewhere else, by something that is not the model.

The market priced it Tuesday

Palo Alto Networks reported fiscal fourth-quarter revenue of $3.41 billion, up 34 percent, with next-generation security ARR at $9.1 billion, up 63 percent. Nikesh Arora said the company has held more than 2,000 customer briefings since the Mythos launch, up from roughly 1,200 a quarter earlier, and announced the acquisition of AI agent startup Console. Leadership said it would keep buying from startups where internal development falls short. CrowdStrike and Okta both surged on the same demand a week earlier.

Two thousand briefings in a quarter is not a product cycle. It is a buyer population that has been told by its own security teams, and increasingly by its carriers, that the agents already inside the perimeter need a control the identity stack does not provide.

Okta’s agent offering intersects scopes when a token is minted. Broadcom’s AgentMinder, which we covered Tuesday, evaluates each call against declared mission and intent. Neither one, as publicly described, would have stood between a Git config file and the developer’s shell — because neither one sits in the path where Git launches a helper. The Manifold class lives below the agent’s tool-execution layer. Any gate that only sees what the agent thinks it is running is looking at the wrong stream.

If the answer is the second one, the control is evaluating the agent’s intentions, not the host’s actions. Those diverged on September 2, in production, across six vendors.

The cost curve, in two numbers

Forescout’s Vedere Labs used Claude to port a working pre-authentication remote code execution exploit from one WAGO programmable logic controller to another, executing attacker-supplied ARM shellcode on live hardware against CVE-2021-31886 (CVSS 9.8, Siemens-assigned, reachable before authentication on TCP 21). The port required sustained researcher steering. The final RCE development stage consumed $535.74 in API usage over eight hours and thirty-two minutes. CERT@VDE says no updates exist for the affected controllers.

Separately, watchTowr reports that JFrog Artifactory CVE-2026-82329 — the authentication bypass to admin we covered last week — is now being exploited in the wild, days after disclosure, under default configuration, with no authentication and no user interaction. JFrog patched in 7.161.20 on August 28.

Under six hundred dollars to port an OT exploit that has no fix. Days from disclosure to exploitation on the artifact repository your build system trusts. The offensive ledger is being automated at commodity prices while the number of humans who can validate an agent’s action before it lands stays flat. That ratio moves in one direction.

What to do this week

1. Inventory every CLI coding agent in use, sanctioned or not. Manifold named six vendors. Assume developers have at least two of them. Check patch level against the September 1 retest list and treat Hermes Agent, Qwen Code and Grok Build as unpatched until proven otherwise.
2. Block .git-intact repository delivery at the edge. Archives, sync folders and removable media that carry a .git directory should be quarantined and re-cloned from a trusted remote before any agent touches them. This closes the delivery constraint the attack depends on.
3. Ask your agent-governance vendor the process-launch question. Get a written answer to whether the control observes and evaluates processes spawned below the agent’s tool layer. If the answer is no, the control has a blind spot with a published technique behind it.
4. Put an execution-time record in front of your carrier before renewal. Underwriting is moving from point-in-time forms to continuous evidence. A log of what agents actually executed on hosts — not what they were scoped to do — is the artifact that survives a claim.
5. Re-verify Artifactory exposure today. If 7.161.20 or the equivalent patched branch is not deployed, assume compromise and rotate admin credentials.

• The Hacker News — “Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code,” 2 September 2026. Primary: Manifold Security disclosure; OpenAI Codex CVEs.
• The Hacker News — “Google, Anthropic, and OpenAI Unveil Cyber AI Models, Safeguards, and Access Programs,” 2 September 2026. Primaries: Google Fairwind Program announcement; OpenAI “Path to Astra”; Anthropic Fable 5.1 / Mythos 5.1 launch and “Improving alignment and security efforts.”
• CNBC — “Palo Alto Networks beats quarterly estimates on AI demand, continues acquisition spree,” 1 September 2026. Primary: PANW Q4 FY2026 release.
• The Hacker News — “Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another,” 2 September 2026. Primary: Forescout Vedere Labs.
• The Hacker News — “Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens Days After Disclosure,” 1 September 2026. Primary: watchTowr.
• NexusRiver Issue 56 — Broadcom AgentMinder GA; Anthropic August 31 postmortem, 1 September 2026.