KDCube
← AI Industry News

Coding Agents' Sandbox Cracks Open a Runtime-Security Market

A core.fsmonitor Git config trick lets a hostile repo run attacker code the moment a coding agent runs git status — before any trust prompt and outside the sandbox — hitting Claude Code, Codex, Cursor, Gemini CLI, Goose and more, with patches landing unevenly. In response a dedicated agent-runtime security market is formin...

Highlights

  • A Git config trick (core.fsmonitor read from a repo's own .git/config) lets a hostile repository run attacker code the moment a coding agent runs git status — before any workspace-trust prompt and outside the sandbox, across Claude Code, Codex, Cursor, Gemini CLI, Goose and more (The Hacker News)
  • Researchers are calling it a trust-handoff flaw, not a classic escape: the agent writes files the host's trusted tooling later executes with the user's full privileges (BleepingComputer)
  • Patches are landing unevenly — Goose 1.44.0, Codex CLI 0.131.0, and a partial Claude Code fix in 2.1.196 — while several agents (Hermes, Qwen Code, Grok Build) were still unpatched at disclosure (The Hacker News)
  • CrowdStrike answered with Falcon Guardian, an endpoint AI Detection & Response product that inventories shadow agents and (pre-beta) puts an AI Gateway in front of MCP traffic (CrowdStrike)

Key Signals

  1. The "week of sandbox escapes" hits every major coding agentdisclosed early Sept, retested Sept 1 The core issue isn't the model — it's the subprocess an agent spawns at startup to figure out where it is. A repo-supplied core.fsmonitor command executes with the user's privileges, no approval dialog shown, sandbox or not (The Hacker News). Techzine and BleepingComputer confirm the same pattern across Cursor, Codex, Gemini CLI and Antigravity, meaning the exposure follows any agent that shells out to Git in an untrusted workspace (Techzine).
  2. Vendor response is fragmented, and that's the operator problemSept 2026 OpenAI published CVEs and shipped fixes quickly; other maintainers closed reports as duplicates, marked them "informative," or left advisories untriaged (The Hacker News). For teams running fleets of coding agents in CI or on developer laptops, "patched" is now a per-agent, per-version question — not a checkbox.
  3. A dedicated agent-runtime security market is formingFal.Con 2026, Sept 1 CrowdStrike's Falcon Guardian ties agent behavior to endpoint telemetry, blocks unauthorized agents, and previews an AI Gateway that applies policy to every call including MCP connections, GA targeted next quarter (CrowdStrike)(SiliconANGLE). Startup AIR Security emerged with $50M to build an inline firewall that vets skills, plugins, and MCP servers before they reach an agent's context (VibeEval roundup).

Why It Matters / What To Watch

  1. Treat coding-agent updates as security-critical, not convenience updates
    • Pin and audit versions: Codex CLI ≥ 0.131.0 and the Claude Code fix in 2.1.196 close the core.fsmonitor path, but coverage varies by agent — assume unpatched until you verify (The Hacker News).
    • Never let an agent auto-run in a freshly cloned, untrusted repo; the payload fires before the trust prompt you were relying on (BleepingComputer).
  2. Runtime and endpoint controls are becoming the real perimeter
    • Evaluate endpoint AIDR and agent access controls to inventory the shadow agents already running on managed machines — governance dashboards won't see what the endpoint does (CrowdStrike).
    • Watch the MCP/skills supply chain: inline firewalls that screen tools and connectors before they touch context are the emerging answer to unvetted add-ons (SiliconANGLE)(VibeEval roundup).

Quick Links