const {P,H2,Callout,Ul,Related,PostHead}=window;
function Article(){
return <>
<PostHead cat="/AI-SECURITY" date="2026-09-10" title="Git status is a tool call" lede="Seven coding agents ran git in the background to “understand the repo.” A config key became argv because git was never an allowlisted tool."/>
<P>Manifold’s GitSpawn class is simple: the agent shells out to git for status, diff, and log. A cloned repo can ship a <span style={{fontFamily:'var(--font-mono)',fontSize:13}}>.git/config</span> that points those commands at attacker-controlled programs. Claude Code, Codex, Cursor, Goose, Qwen Code, Grok Build, Hermes. Four were still open on a 1 Sep retest. We are not publishing the keys.</P>
<P>The harness runs git with the repo’s config. If the broker does not name git as a tool, does not pin the binary, and does not refuse repo-local hooks, you have a chat box with side effects. See <a href="post-four-gates.html">four gates</a>.</P>
<H2>What failed</H2>
<Ul items={[
'Allowlist: git was not a named tool. It was ambient context collection.',
'Schema: config values became execution. Extra keys were not dropped.',
'Sandbox: the process could run whatever the repo named, as the user.',
'Confirm: background git has no human in the loop. That is the point of background.'
]}/>
<Callout>Vendor patches that “ignore unknown config” are a local fix. The harness still has to decide whether git runs at all, with which binary, from which working tree.</Callout>
<H2>What we look for on an agent desk</H2>
<P>Does the agent clone untrusted remotes? Does it run git before a scope file says the tree is in-bounds? Can a retrieved README or a submodule change the tool list? If yes, stop. The finding is that context collection was execution.</P>
<P>Same thesis as <a href="post-loops.html">prompts → loops</a>: the attack surface moved when the model got a shell. GitSpawn is just the loop touching a config file you did not inventory.</P>
<Related items={[
['post-four-gates.html','Four gates: allowlist, schema, sandbox, confirm'],
['post-loops.html','From prompts to loops'],
['post-skill.html','A router for reverse-engineering agents']
]}/>
</>;
}
window.Article=Article;
mountPost();