{"id":6720,"date":"2026-09-01T15:07:42","date_gmt":"2026-09-01T15:07:42","guid":{"rendered":"https:\/\/areeblog.com\/?p=6720"},"modified":"2026-09-01T15:07:42","modified_gmt":"2026-09-01T15:07:42","slug":"ai-coding-agents-found-running-malicious-git-commands-before-user-approval","status":"publish","type":"post","link":"https:\/\/areeblog.com\/ai-coding-agents-found-running-malicious-git-commands-before-user-approval\/","title":{"rendered":"AI Coding Agents Found Running Malicious Git Commands Before User Approval"},"content":{"rendered":"

\"AI<\/p>\n

Security researchers at Manifold Security have identified six high-severity security findings across five AI coding agents<\/a> that can allow attacker-controlled code to run while the agents gather repository information.<\/p>\n

The research, published September 1, 2026, covers Claude Code, Qwen Code, Goose, Grok Build and Hermes Agent. Manifold said two of the six findings had been fixed, while four remained unpatched when the research was published.<\/p>\n

The common issue is the way the agents use Git in the background. Several agents automatically run Git commands to determine the state of a project, sometimes before a user has entered a prompt, accepted a workspace-trust request or, in one case, authenticated.<\/p>\n

Manifold called the vulnerability class GitSpawn<\/strong>. The researchers found that some of these Git calls did not remove repository-controlled configuration before invoking Git.<\/p>\n

Git’s official configuration documentation<\/a> states that core.fsmonitor<\/code> can point to an external filesystem-monitor command. Git can invoke that command during operations that refresh the index, including git status<\/code>.<\/p>\n

That creates a problem for AI coding agents that automatically run commands such as git status<\/code> or git diff<\/code>. A repository’s .git\/config<\/code> can specify an executable command, and Git can run it as part of the background operation.<\/p>\n

Manifold said the command executes on the host with the privileges of the developer running the agent. In the affected scenarios described by the researchers, the execution occurs outside the agent’s normal approval mechanism and before the model is necessarily involved.<\/p>\n

The researchers emphasized that Git itself is not being described as having a newly discovered flaw. core.fsmonitor<\/code> is an intended Git feature designed to speed up operations on repositories containing large numbers of files.<\/p>\n

The security problem comes from allowing untrusted repository configuration to control an automatically executed Git process before the AI agent’s own security controls are applied.<\/p>\n

The delivery method also has an important limitation. Git does not normally transfer the local .git\/config<\/code> file when a user clones, fetches or pulls from a remote repository. Manifold said its proof-of-concept repositories were instead delivered as files containing the existing .git<\/code> directory, such as through ZIP archives, shared drives, synchronized folders or removable media.<\/p>\n

For Claude Code, Manifold identified two separate findings. The first involved core.fsmonitor<\/code>. The researchers said Claude Code ran git status<\/code> during repository-context gathering at startup, before the workspace-trust prompt was accepted.<\/p>\n

The issue was confirmed on Claude Code 2.1.193 and reported on June 26, 2026. Manifold said it was closed as a duplicate of a report filed earlier that day and was fixed in version 2.1.196.<\/p>\n

The second Claude Code finding involved the ultrareview<\/code> workflow and a different Git configuration setting capable of executing a command. Manifold deliberately did not identify that setting while the issue remained unpatched.<\/p>\n

The ultrareview<\/code> finding was reported July 15, 2026, on version 2.1.210. Manifold said it was closed as a duplicate of an internal ticket but remained unpatched when researchers confirmed it again on version 2.1.252 on September 1.<\/p>\n

Goose was also affected. Manifold found that goose review<\/code> used Git to collect the changes being reviewed without removing attacker-controlled Git configuration.<\/p>\n

According to the project’s published security advisory<\/a>, the review command can invoke git diff HEAD<\/code> during context collection. A malicious core.fsmonitor<\/code> setting can then cause Git to execute the configured command during the index refresh.<\/p>\n

The Goose issue affected version 1.41.0 at the time of testing and was reported July 13. It was fixed in version 1.44.0 and assigned CVE-2026-72718<\/strong>, with a CVSS 4.0 score of 7.0, classified as high severity.<\/p>\n

The Goose advisory says the command can execute with the privileges of the user running Goose and inherit the user’s environment, potentially exposing environment secrets and provider API keys.<\/p>\n

Manifold found a similar issue in Hermes Agent. The agent runs git status<\/code> while gathering repository context and, according to the researchers, passes the repository’s Git configuration through unchanged.<\/p>\n

The issue was confirmed on Hermes 0.18.2 on July 19 and reported the following day. Manifold said it made six contact attempts through five channels without the private security advisory being triaged.<\/p>\n

The researchers assigned the issue CVE-2026-71963<\/strong> through VulnCheck, which Manifold described as an independent CVE Numbering Authority. The issue was confirmed again on Hermes 0.21.0 on September 1 and remained unpatched.<\/p>\n

Qwen Code was another affected product. Manifold said Qwen Code runs git status<\/code> at startup to gather repository context and leaves the repository’s configuration available to Git.<\/p>\n

The researchers said the payload could execute when a user opened a folder with Qwen Code, before authentication had taken place. The finding was confirmed on version 0.19.6 and reported to Alibaba’s security response centre on July 7, where it was accepted.<\/p>\n

Manifold re-tested the issue on Qwen Code 0.22.3 on September 1 and reported that it remained unpatched.<\/p>\n

A separate Qwen Code security issue<\/a> also describes the underlying problem: commands treated as read-only can execute programs configured outside the command text through repository Git settings such as diff.external<\/code> and core.fsmonitor<\/code>.<\/p>\n

Grok Build showed another variation of the same problem. Manifold said the agent runs Git to gather repository context and leaves the repository configuration available to that process.<\/p>\n

In its test, opening a repository with Grok Build and beginning to type a prompt was enough to trigger the payload on the first keystroke, before the message was sent.<\/p>\n

The finding was confirmed on Grok Build 0.2.93. Manifold said an earlier report of the same class had been filed July 1 and closed as informative. Its report followed on July 14 and was closed as a duplicate of the earlier report.<\/p>\n

Manifold confirmed the issue again on version 1.0.13 on September 1 and said it remained unpatched.<\/p>\n

Across the six findings, Manifold’s disclosure timeline shows Claude Code’s core.fsmonitor<\/code> issue reported June 26 and patched in 2.1.196; Qwen Code reported July 7 and still unpatched in 0.22.3; Goose reported July 13 and patched in 1.44.0; Grok Build reported July 14 and still unpatched in 1.0.13; Claude Code’s ultrareview<\/code> issue reported July 15 and still unpatched in 2.1.252; and Hermes reported July 20 and still unpatched in 0.21.0.<\/p>\n

Manifold said every finding was reported privately. The company also said every finding that remained unpatched was re-confirmed against a current release before publication. It found the same type of flaw in additional agents that it did not name.<\/p>\n

The researchers said the issue is not limited to core.fsmonitor<\/code>. Git contains other configuration mechanisms that can cause external programs to run, which means disabling one setting may not address every execution path.<\/p>\n

For developers using affected tools, Manifold recommends inspecting .git\/config<\/code> before opening an unfamiliar repository with an AI coding agent. For developers building such agents, it recommends sanitizing Git configuration during automatic context gathering. One example given by the researchers is running git -c core.fsmonitor=false status<\/code>.<\/p>\n

The research also highlights a distinction between the command an agent appears to execute and what Git can actually do after reading repository configuration. A command such as git status<\/code> or git diff<\/code> may be treated as read-only by an agent’s permission system while still causing Git to invoke an externally configured program.<\/p>\n

That issue has also appeared in Qwen Code’s own public tracking. The project’s security discussion notes that command-text analysis cannot detect execution caused by settings stored in .git\/config<\/code>, and identifies additional configuration areas that require review.<\/p>\n

Manifold said the five projects covered in its report collectively represent a large user base. It cited more than 77 million monthly npm downloads for Claude Code and GitHub star counts of more than 237,000 for Hermes, 143,000 for Claude Code, 54,000 for Goose, 27,000 for Qwen Code and 26,000 for Grok Build at the time of publication.<\/p>\n

The research raises a broader security concern around background operations performed by AI coding tools. In the affected cases, the security-sensitive action takes place in the software surrounding the model rather than through an instruction generated by the model itself.<\/p>\n","protected":false},"excerpt":{"rendered":"

Security researchers at Manifold Security have identified six high-severity security findings across five AI coding agents that can allow attacker-controlled code to run while the agents gather repository information. The research, published September 1, 2026, covers Claude Code, Qwen Code, Goose, Grok Build and Hermes Agent. Manifold said two of the six findings had been […]<\/p>\n","protected":false},"author":2,"featured_media":6721,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"content-type":"","_monsterinsights_skip_tracking":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[164],"tags":[166],"class_list":["post-6720","post","type-post","status-publish","format-standard","has-post-thumbnail","category-tech-updates","tag-ai"],"share_on_mastodon":{"url":"https:\/\/mastodon.social\/@Areeblog\/117196430500164509","error":""},"yoast_head":"\nAI Coding Agents Found Running Malicious Git Commands Before User Approval - Aree Blog<\/title>\n<meta name=\"description\" content=\"AI coding agents can run malicious Git commands before user approval, exposing developers to high-severity security risks.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/areeblog.com\/ai-coding-agents-found-running-malicious-git-commands-before-user-approval\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"AI Coding Agents Found Running Malicious Git Commands Before User Approval\" \/>\n<meta property=\"og:description\" content=\"AI coding agents can run malicious Git commands before user approval, exposing developers to high-severity security risks.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/areeblog.com\/ai-coding-agents-found-running-malicious-git-commands-before-user-approval\/\" \/>\n<meta property=\"og:site_name\" content=\"Aree Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-01T15:07:42+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/areeblog.com\/wp-content\/uploads\/2026\/09\/IMG-20260901-WA0010.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"853\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Daniel Chinonso John\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Daniel Chinonso John\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/areeblog.com\\\/ai-coding-agents-found-running-malicious-git-commands-before-user-approval\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/areeblog.com\\\/ai-coding-agents-found-running-malicious-git-commands-before-user-approval\\\/\"},\"author\":{\"name\":\"Daniel Chinonso John\",\"@id\":\"https:\\\/\\\/areeblog.com\\\/#\\\/schema\\\/person\\\/d972222c55618fb0f4b4c0c11ff52f63\"},\"headline\":\"AI Coding Agents Found Running Malicious Git Commands Before User Approval\",\"datePublished\":\"2026-09-01T15:07:42+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/areeblog.com\\\/ai-coding-agents-found-running-malicious-git-commands-before-user-approval\\\/\"},\"wordCount\":1248,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/areeblog.com\\\/ai-coding-agents-found-running-malicious-git-commands-before-user-approval\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/areeblog.com\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/IMG-20260901-WA0010.jpg\",\"keywords\":[\"AI\"],\"articleSection\":[\"Tech Updates\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/areeblog.com\\\/ai-coding-agents-found-running-malicious-git-commands-before-user-approval\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/areeblog.com\\\/ai-coding-agents-found-running-malicious-git-commands-before-user-approval\\\/\",\"url\":\"https:\\\/\\\/areeblog.com\\\/ai-coding-agents-found-running-malicious-git-commands-before-user-approval\\\/\",\"name\":\"AI Coding Agents Found Running Malicious Git Commands Before User Approval - Aree Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/areeblog.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/areeblog.com\\\/ai-coding-agents-found-running-malicious-git-commands-before-user-approval\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/areeblog.com\\\/ai-coding-agents-found-running-malicious-git-commands-before-user-approval\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/areeblog.com\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/IMG-20260901-WA0010.jpg\",\"datePublished\":\"2026-09-01T15:07:42+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/areeblog.com\\\/#\\\/schema\\\/person\\\/d972222c55618fb0f4b4c0c11ff52f63\"},\"description\":\"AI coding agents can run malicious Git commands before user approval, exposing developers to high-severity security risks.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/areeblog.com\\\/ai-coding-agents-found-running-malicious-git-commands-before-user-approval\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/areeblog.com\\\/ai-coding-agents-found-running-malicious-git-commands-before-user-approval\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/areeblog.com\\\/ai-coding-agents-found-running-malicious-git-commands-before-user-approval\\\/#primaryimage\",\"url\":\"https:\\\/\\\/areeblog.com\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/IMG-20260901-WA0010.jpg\",\"contentUrl\":\"https:\\\/\\\/areeblog.com\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/IMG-20260901-WA0010.jpg\",\"width\":1280,\"height\":853,\"caption\":\"AI Coding Agents Found Running Malicious Git Commands Before User Approval\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/areeblog.com\\\/ai-coding-agents-found-running-malicious-git-commands-before-user-approval\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/areeblog.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"AI Coding Agents Found Running Malicious Git Commands Before User Approval\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/areeblog.com\\\/#website\",\"url\":\"https:\\\/\\\/areeblog.com\\\/\",\"name\":\"Aree Blog\",\"description\":\"Unfiltered Perspectives, Unstoppable Insights\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/areeblog.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/areeblog.com\\\/#\\\/schema\\\/person\\\/d972222c55618fb0f4b4c0c11ff52f63\",\"name\":\"Daniel Chinonso John\",\"description\":\"Daniel Chinonso John is a web designer, penetration tester, and founder of Aree Tech. He writes clear, actionable posts at the intersection of productivity, AI, cybersecurity, and blogging to help readers get things done.\",\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/in\\\/daniel-john-45183a169\\\/\"],\"url\":\"https:\\\/\\\/areeblog.com\\\/author\\\/danojohn55gmail-com\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"AI Coding Agents Found Running Malicious Git Commands Before User Approval - Aree Blog","description":"AI coding agents can run malicious Git commands before user approval, exposing developers to high-severity security risks.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/areeblog.com\/ai-coding-agents-found-running-malicious-git-commands-before-user-approval\/","og_locale":"en_US","og_type":"article","og_title":"AI Coding Agents Found Running Malicious Git Commands Before User Approval","og_description":"AI coding agents can run malicious Git commands before user approval, exposing developers to high-severity security risks.","og_url":"https:\/\/areeblog.com\/ai-coding-agents-found-running-malicious-git-commands-before-user-approval\/","og_site_name":"Aree Blog","article_published_time":"2026-09-01T15:07:42+00:00","og_image":[{"width":1280,"height":853,"url":"https:\/\/areeblog.com\/wp-content\/uploads\/2026\/09\/IMG-20260901-WA0010.jpg","type":"image\/jpeg"}],"author":"Daniel Chinonso John","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Daniel Chinonso John","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/areeblog.com\/ai-coding-agents-found-running-malicious-git-commands-before-user-approval\/#article","isPartOf":{"@id":"https:\/\/areeblog.com\/ai-coding-agents-found-running-malicious-git-commands-before-user-approval\/"},"author":{"name":"Daniel Chinonso John","@id":"https:\/\/areeblog.com\/#\/schema\/person\/d972222c55618fb0f4b4c0c11ff52f63"},"headline":"AI Coding Agents Found Running Malicious Git Commands Before User Approval","datePublished":"2026-09-01T15:07:42+00:00","mainEntityOfPage":{"@id":"https:\/\/areeblog.com\/ai-coding-agents-found-running-malicious-git-commands-before-user-approval\/"},"wordCount":1248,"commentCount":0,"image":{"@id":"https:\/\/areeblog.com\/ai-coding-agents-found-running-malicious-git-commands-before-user-approval\/#primaryimage"},"thumbnailUrl":"https:\/\/areeblog.com\/wp-content\/uploads\/2026\/09\/IMG-20260901-WA0010.jpg","keywords":["AI"],"articleSection":["Tech Updates"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/areeblog.com\/ai-coding-agents-found-running-malicious-git-commands-before-user-approval\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/areeblog.com\/ai-coding-agents-found-running-malicious-git-commands-before-user-approval\/","url":"https:\/\/areeblog.com\/ai-coding-agents-found-running-malicious-git-commands-before-user-approval\/","name":"AI Coding Agents Found Running Malicious Git Commands Before User Approval - Aree Blog","isPartOf":{"@id":"https:\/\/areeblog.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/areeblog.com\/ai-coding-agents-found-running-malicious-git-commands-before-user-approval\/#primaryimage"},"image":{"@id":"https:\/\/areeblog.com\/ai-coding-agents-found-running-malicious-git-commands-before-user-approval\/#primaryimage"},"thumbnailUrl":"https:\/\/areeblog.com\/wp-content\/uploads\/2026\/09\/IMG-20260901-WA0010.jpg","datePublished":"2026-09-01T15:07:42+00:00","author":{"@id":"https:\/\/areeblog.com\/#\/schema\/person\/d972222c55618fb0f4b4c0c11ff52f63"},"description":"AI coding agents can run malicious Git commands before user approval, exposing developers to high-severity security risks.","breadcrumb":{"@id":"https:\/\/areeblog.com\/ai-coding-agents-found-running-malicious-git-commands-before-user-approval\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/areeblog.com\/ai-coding-agents-found-running-malicious-git-commands-before-user-approval\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/areeblog.com\/ai-coding-agents-found-running-malicious-git-commands-before-user-approval\/#primaryimage","url":"https:\/\/areeblog.com\/wp-content\/uploads\/2026\/09\/IMG-20260901-WA0010.jpg","contentUrl":"https:\/\/areeblog.com\/wp-content\/uploads\/2026\/09\/IMG-20260901-WA0010.jpg","width":1280,"height":853,"caption":"AI Coding Agents Found Running Malicious Git Commands Before User Approval"},{"@type":"BreadcrumbList","@id":"https:\/\/areeblog.com\/ai-coding-agents-found-running-malicious-git-commands-before-user-approval\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/areeblog.com\/"},{"@type":"ListItem","position":2,"name":"AI Coding Agents Found Running Malicious Git Commands Before User Approval"}]},{"@type":"WebSite","@id":"https:\/\/areeblog.com\/#website","url":"https:\/\/areeblog.com\/","name":"Aree Blog","description":"Unfiltered Perspectives, Unstoppable Insights","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/areeblog.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/areeblog.com\/#\/schema\/person\/d972222c55618fb0f4b4c0c11ff52f63","name":"Daniel Chinonso John","description":"Daniel Chinonso John is a web designer, penetration tester, and founder of Aree Tech. He writes clear, actionable posts at the intersection of productivity, AI, cybersecurity, and blogging to help readers get things done.","sameAs":["https:\/\/www.linkedin.com\/in\/daniel-john-45183a169\/"],"url":"https:\/\/areeblog.com\/author\/danojohn55gmail-com\/"}]}},"jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":6735,"url":"https:\/\/areeblog.com\/researchers-find-ai-coding-agents-can-turn-llms-txt-into-a-software-supply-chain-attack-surface\/","url_meta":{"origin":6720,"position":0},"title":"Researchers Find AI Coding Agents Can Turn llms.txt Into a Software Supply-Chain Attack Surface","author":"Daniel Chinonso John","date":"September 3, 2026","format":false,"excerpt":"Security researchers have demonstrated that AI coding agents can execute unclaimed software packages referenced by trusted-looking website documentation, creating a potential software supply-chain attack path for companies using autonomous coding tools. The research focused on llms.txt and llms-full.txt, machine-readable files increasingly published by websites to summarize their content and structure\u2026","rel":"","context":"In "Tech Updates"","block_context":{"text":"Tech Updates","link":"https:\/\/areeblog.com\/category\/tech-updates\/"},"img":{"alt_text":"Researchers Find AI Coding Agents Can Turn llms.txt Into a Software Supply-Chain Attack Surface","src":"https:\/\/i0.wp.com\/areeblog.com\/wp-content\/uploads\/2026\/09\/IMG-20260903-WA0006.jpg?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/areeblog.com\/wp-content\/uploads\/2026\/09\/IMG-20260903-WA0006.jpg?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/areeblog.com\/wp-content\/uploads\/2026\/09\/IMG-20260903-WA0006.jpg?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/areeblog.com\/wp-content\/uploads\/2026\/09\/IMG-20260903-WA0006.jpg?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/areeblog.com\/wp-content\/uploads\/2026\/09\/IMG-20260903-WA0006.jpg?resize=1050%2C600&ssl=1 3x"},"classes":[]},{"id":6629,"url":"https:\/\/areeblog.com\/operant-ai-launches-semantic-firewall-to-stop-malicious-actions-by-ai-agents-in-real-time\/","url_meta":{"origin":6720,"position":1},"title":"Operant AI Launches Semantic Firewall to Stop Malicious Actions by AI Agents in Real Time","author":"Daniel Chinonso John","date":"August 28, 2026","format":false,"excerpt":"Operant AI has launched a new security product designed to stop potentially malicious actions by AI agents before they are executed, as companies increasingly deploy agents capable of running code, accessing databases and interacting with enterprise systems. San Francisco-based Operant AI announced on August 27, 2026, that its Operant Semantic\u2026","rel":"","context":"In "Tech Updates"","block_context":{"text":"Tech Updates","link":"https:\/\/areeblog.com\/category\/tech-updates\/"},"img":{"alt_text":"Operant AI Launches Semantic Firewall to Stop Malicious Actions by AI Agents in Real Time","src":"https:\/\/i0.wp.com\/areeblog.com\/wp-content\/uploads\/2026\/08\/images-38.jpeg?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/areeblog.com\/wp-content\/uploads\/2026\/08\/images-38.jpeg?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/areeblog.com\/wp-content\/uploads\/2026\/08\/images-38.jpeg?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/areeblog.com\/wp-content\/uploads\/2026\/08\/images-38.jpeg?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":6626,"url":"https:\/\/areeblog.com\/gitea-critical-vulnerability-cve-2026-60004-added-to-cisa-catalog-after-active-exploitation\/","url_meta":{"origin":6720,"position":2},"title":"Gitea Critical Vulnerability CVE-2026-60004 Added to CISA Catalog After Active Exploitation","author":"Daniel Chinonso John","date":"August 27, 2026","format":false,"excerpt":"A critical vulnerability in Gitea, the open-source Git hosting and software development platform, is being actively exploited, with the U.S. Cybersecurity and Infrastructure Security Agency (CISA) adding the flaw to its Known Exploited Vulnerabilities catalog. Tracked as CVE-2026-60004, the vulnerability can allow attackers to execute shell commands on affected Gitea\u2026","rel":"","context":"In "Tech Updates"","block_context":{"text":"Tech Updates","link":"https:\/\/areeblog.com\/category\/tech-updates\/"},"img":{"alt_text":"Gitea Critical Vulnerability CVE-2026-60004 Added to CISA Catalog After Active Exploitation","src":"https:\/\/i0.wp.com\/areeblog.com\/wp-content\/uploads\/2026\/08\/unnamed-1.jpg?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/areeblog.com\/wp-content\/uploads\/2026\/08\/unnamed-1.jpg?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/areeblog.com\/wp-content\/uploads\/2026\/08\/unnamed-1.jpg?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/areeblog.com\/wp-content\/uploads\/2026\/08\/unnamed-1.jpg?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":6839,"url":"https:\/\/areeblog.com\/google-says-hackers-are-using-ai-agents-to-run-multi-stage-attacks-with-little-human-input\/","url_meta":{"origin":6720,"position":3},"title":"Google Says Hackers Are Using AI Agents to Run Multi-Stage Attacks With Little Human Input","author":"Daniel Chinonso John","date":"September 9, 2026","format":false,"excerpt":"Hackers are increasingly using artificial intelligence to automate multiple stages of cyberattacks, with Google Threat Intelligence Group reporting that some attackers have moved beyond simple prompting to AI-driven workflows capable of scanning targets, troubleshooting failures and harvesting credentials with limited human involvement. In a report published September 8, 2026, Google\u2026","rel":"","context":"In "Tech Updates"","block_context":{"text":"Tech Updates","link":"https:\/\/areeblog.com\/category\/tech-updates\/"},"img":{"alt_text":"Google Says Hackers Are Using AI Agents to Run Multi-Stage Attacks With Little Human Input","src":"https:\/\/i0.wp.com\/areeblog.com\/wp-content\/uploads\/2026\/09\/images-55.jpeg?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/areeblog.com\/wp-content\/uploads\/2026\/09\/images-55.jpeg?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/areeblog.com\/wp-content\/uploads\/2026\/09\/images-55.jpeg?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":6308,"url":"https:\/\/areeblog.com\/secure-coding-practices-in-the-ai-era\/","url_meta":{"origin":6720,"position":4},"title":"Secure Coding Practices in the AI Era","author":"Samuel Ogori","date":"July 12, 2026","format":false,"excerpt":"Writing code has never been easier. Ironically, keeping that code secure has never demanded more attention. AI coding assistants can generate hundreds of lines of functional code in seconds, recommend libraries, explain unfamiliar frameworks, and even fix bugs. That speed is undeniably useful. But speed also has a way of\u2026","rel":"","context":"In "Artificial Intelligence"","block_context":{"text":"Artificial Intelligence","link":"https:\/\/areeblog.com\/category\/artificial-intelligence\/"},"img":{"alt_text":"Secure Coding Practices in the AI Era","src":"https:\/\/i0.wp.com\/areeblog.com\/wp-content\/uploads\/2026\/07\/IMG-20260712-WA0006.jpg?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/areeblog.com\/wp-content\/uploads\/2026\/07\/IMG-20260712-WA0006.jpg?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/areeblog.com\/wp-content\/uploads\/2026\/07\/IMG-20260712-WA0006.jpg?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/areeblog.com\/wp-content\/uploads\/2026\/07\/IMG-20260712-WA0006.jpg?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/areeblog.com\/wp-content\/uploads\/2026\/07\/IMG-20260712-WA0006.jpg?resize=1050%2C600&ssl=1 3x"},"classes":[]},{"id":6893,"url":"https:\/\/areeblog.com\/claude-code-adds-agents-md-support-as-ai-coding-tools-adopt-shared-standards\/","url_meta":{"origin":6720,"position":5},"title":"Claude Code Adds AGENTS.md Support as AI Coding Tools Adopt Shared Standards","author":"Samuel Ogori","date":"September 19, 2026","format":false,"excerpt":"Anthropic has added support for AGENTS.md to Claude Code, allowing the coding assistant to use the file as project instructions when a repository does not contain a CLAUDE.md file. The change arrived with Claude Code 2.1.277, released on September 18, 2026. The release notes state that the new behavior can\u2026","rel":"","context":"In "Tech Updates"","block_context":{"text":"Tech Updates","link":"https:\/\/areeblog.com\/category\/tech-updates\/"},"img":{"alt_text":"Claude Code Adds AGENTS.md Support as AI Coding Tools Adopt Shared Standards","src":"https:\/\/i0.wp.com\/areeblog.com\/wp-content\/uploads\/2026\/09\/claude-code-elite-development-teams-shipping-5-10x-faster-october-2025.webp?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/areeblog.com\/wp-content\/uploads\/2026\/09\/claude-code-elite-development-teams-shipping-5-10x-faster-october-2025.webp?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/areeblog.com\/wp-content\/uploads\/2026\/09\/claude-code-elite-development-teams-shipping-5-10x-faster-october-2025.webp?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/areeblog.com\/wp-content\/uploads\/2026\/09\/claude-code-elite-development-teams-shipping-5-10x-faster-october-2025.webp?resize=700%2C400&ssl=1 2x"},"classes":[]}],"jetpack_featured_media_url":"https:\/\/areeblog.com\/wp-content\/uploads\/2026\/09\/IMG-20260901-WA0010.jpg","_links":{"self":[{"href":"https:\/\/areeblog.com\/wp-json\/wp\/v2\/posts\/6720","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/areeblog.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/areeblog.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/areeblog.com\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/areeblog.com\/wp-json\/wp\/v2\/comments?post=6720"}],"version-history":[{"count":1,"href":"https:\/\/areeblog.com\/wp-json\/wp\/v2\/posts\/6720\/revisions"}],"predecessor-version":[{"id":6722,"href":"https:\/\/areeblog.com\/wp-json\/wp\/v2\/posts\/6720\/revisions\/6722"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/areeblog.com\/wp-json\/wp\/v2\/media\/6721"}],"wp:attachment":[{"href":"https:\/\/areeblog.com\/wp-json\/wp\/v2\/media?parent=6720"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/areeblog.com\/wp-json\/wp\/v2\/categories?post=6720"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/areeblog.com\/wp-json\/wp\/v2\/tags?post=6720"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}