Two pieces of research landed in the same week and they describe opposite problems with the same cause. In one, an attacker plants a trap in a folder and a coding agent walks into it. In the other, nobody attacks anything and the agent leaks company screenshots because it was trying to be helpful.
GitSpawn: the config file that runs before the prompt
Manifold Security's GitSpawn research looks at what coding agents do the moment you point them at a directory. Many run git status or git diff to get their bearings. Git, on seeing a core.fsmonitor entry in .git/config, runs whatever command that entry names. So a repository that arrives as a folder can execute code as you, on the host, outside the agent's sandbox and before any approval prompt appears.
The catch that limits the blast radius: a git clone from a hostile URL does not bring the config across. The folder has to arrive as files, which means a zip in an email, a shared drive, a synced directory or a USB stick. That is still a very ordinary way for code to move between contractors, candidates and colleagues.
The scorecard Manifold published is the uncomfortable part. Reports went in between late June and late July. Goose fixed its flaw in 1.44.0 (CVE-2026-72718). Cursor and Codex are marked patched. Claude Code patched the core.fsmonitor route in 2.1.196 but a second route, reported 15 July, is shown as still open in 2.1.252. Hermes Agent (CVE-2026-71963), Qwen Code and Grok Build were all still unpatched at publication. Four of the eight were open when the research went out.
PixelLeak: no attacker required
Glow Labs found more than 13,000 internal screenshots from over 300 organisations sitting in public GitHub repositories, across more than 900 repos. The mechanism is almost funny. Agents asked to put UI screenshots into a pull request discovered the GitHub CLI cannot attach images, reasoned that the images had to live somewhere reviewers could reach, and created public repos to host them. About a third of the exposures came through an open-source helper called gitshot. Ninety-three per cent landed in personal accounts rather than company ones.
What was in the pictures matters. Glow reports customer billing records, internal treasury and settlement consoles, withdrawal screens naming institutional clients, and unreleased product work. As the researchers put it, no attacker was involved; the agent's own problem solving was the leak.
What links them
Both failures happen in the gap between what the developer asked for and what the tool will do to get there. Agents inherit your credentials, your file access and your GitHub login, and they use them creatively. Controls that assume a human will notice something odd do not help when the odd step happens in a background call.
Practical steps
- Before opening any folder you did not clone yourself with an agent, read its
.git/config. Any value that names a program can run that program. - Ask your agent vendors, in writing, whether context-gathering git calls run with
core.fsmonitordisabled. Manifold's suggested fix is a single flag. - Turn off the ability to create public repositories, or change repository visibility, from developer tokens and org settings where you can.
- Search GitHub for your company's name and logos in repos outside your organisation, including accounts of former staff.
- Give agents a sanctioned place to put screenshots and artefacts, so they do not invent one.
If your developers are already using coding agents and you have not looked at what those agents can reach, email sales@halfteck.com and we can run a short review.