Company
Security research company that analyzes software supply-chain and AI-agent threats, including malicious extensions and booby-trapped documentation domains.
Manifold Security's GitSpawn lets a repo's .git/config run any command through a coding agent's background git calls, with no approval prompt. It needs the repo to arrive as files, since git clone never carries that config; a client's zip will do.
Reality
Manifold Security reported eight instances across seven command-line agents. The command runs as the user, outside the sandbox, with no approval prompt, and four were still firing when the researchers retested on September 1.
Reality
OpenAI's new model thinks repeatedly before it acts, and according to Manifold Security's CTO it usually does so without leaving the reasoning trace that agent audits read. Oversight moves to the buyer.
Perspective Coverage
18 publishersReality
third-party.com is an ordinary registered domain that developer documentation has used as a stand-in for years. It currently answers with a fake Cloudflare check that tells Windows users to paste a PowerShell command into the Run box.
Reality
Gal Weizman showed that one malicious extension can take over the AI agents in Chrome, Comet, Edge, Neon and Claude in Chrome, with bounties from all five vendors to show for it. Installation is the only precondition.
Perspective Coverage
3 publishersReality
Manifold Security found third-party.com, a placeholder in more than 1,700 public repositories, serving a ClickFix clipboard lure to Windows browsers since at least June 2026. Static scans of the same files come back clean, because the server chooses what to send.
Reality
Meta, Google and Instinct have shipped agents that book travel and clear inboxes, and each one needs a credit card or an email password to do it. The approval prompt for the risky step lands on whoever holds the login.
Reality
Forever Security showed the same technique working against Gemini in Chrome, Comet, Edge, Opera Neon and the Claude extension. Google and Microsoft have shipped fixes; the other three findings rest on the researchers' own account.
Reality
Manifold Security's GitSpawn findings cover eight issues across seven coding agents. The path runs through core.fsmonitor, where a background git status starts a helper the repository chose, outside the agent's sandbox and with no prompt.
Reality
The wiki's old software took a plain GET as an edit, so a harness that policed request types could not stop the writes. GitSpawn puts the same gap in the startup git calls of seven coding agents.
Reality
Open VSX's malicious list is an array of bare identifiers, so freeing an impersonated publisher also erases the record that the same name once shipped malware.
Reality