/QAble Weekly/Vol. 012 · 11 Sep 2026

● This week’s signal » Your coding agent reads a file, and the file tells it what to run. That is not a bug in one tool, it is how the whole category currently works.

Weekly

Signal Over Noise

‹ PrevNext ›

For Engineering
Leaders

5-minute read

‹ PrevNext ›

Friday, 11 September 2026 · Vol. 012

In Brief

GitSpawn lets a repository run code in seven AI coding agentsSep 2
120 llms.txt files found pointing at unregistered packagesSep 4
Meta launches Muse, its personal AI agentSep 8
Cylake raises $245M before it has a productSep 8
JFrog Artifactory flaw weaponised four days after patchSep 1
The Exploration Company raises $450M Series CSep 8
GitSpawn lets a repository run code in seven AI coding agentsSep 2
120 llms.txt files found pointing at unregistered packagesSep 4
Meta launches Muse, its personal AI agentSep 8
Cylake raises $245M before it has a productSep 8
JFrog Artifactory flaw weaponised four days after patchSep 1
The Exploration Company raises $450M Series CSep 8

Story of the Week

Open the wrong folder and your AI agent runs a stranger’s code

Two pieces of research published days apart landed on the same finding. First, on September 2, Manifold Security disclosed GitSpawn: eight flaws across seven AI coding agents. Git has a legitimate performance setting, core.fsmonitor, which lets a repository name a helper program that Git runs whenever it refreshes its index. Coding agents quietly run git status on startup to gather context. If the agent does not neutralise the repository’s own config first, the repository chooses what runs. No prompt typed, no approval clicked, in some cases before the user has authenticated. Claude Code, Codex, Cursor, Goose, Grok Build, Hermes and Qwen Code were all affected. One important limit: the repo has to arrive as files with its .git folder intact, via a shared drive, archive or USB stick. A normal git clone is not vulnerable. Then on September 4, a separate team scanned 6,214 domains belonging to defence contractors and Fortune 500 firms, and found 120 published llms.txt files pointing at package names nobody had registered. They registered one. A Fortune 500 network called home within the hour.

Why it matters: Both attacks work because agents treat documents as instructions. Any file your agent reads is executable input until you prove otherwise. If a repository reaches you as files rather than a clone, inspect .git/config before opening it in an agent. That is a one-line check that defeats GitSpawn.

GitSpawn abuses a legitimate Git performance setting, core.fsmonitor, that lets a repository name a program for Git to run. · Logo: Git

WeeklySection 01 · This Week’s Launches

Product Launches

Meta built an elaborate cage for its new assistant. Your dev tools have none of it.

What: Meta spent real engineering effort building a cage around its new consumer agent. The contrast with developer tooling is the story.

On September 8, Meta launched Muse, a personal AI agent that books travel, sends email and runs errands, built on the Muse Spark model we covered last week. It is rolling out in the US on iOS, Android and muse.ai, with AI glasses to follow. Ignore the assistant for a moment and look at what Meta built around it. Muse runs inside its own Secure VM, a dedicated machine holding the agent and that person’s data, isolated so that, in Meta’s words, “no one else’s agent can reach it.” A separate system-level watcher called Sentinel sits in front of the network: “Nothing Muse does reaches the internet unless the Sentinel approves it.” Muse has no visibility into passwords or payment methods, using credentials from secure storage without seeing them, and paying through single-use card numbers. A Confidential VM due later this year encrypts the whole environment under a key only the user holds. Set that beside story 01. Meta assumed its agent would be attacked and built the approval gate first.

Why it matters: The pattern to copy is Sentinel: a separate component that approves outbound actions, rather than trusting the agent to police itself. Ask of any agent you deploy: what sits between it and the network, and who wrote that thing? If the answer is nothing, you are the control.

Launch Log

Meta Muse
A personal AI agent on iOS, Android and muse.ai, running in a dedicated Secure VM behind a Sentinel approval gate, paying with single-use card numbers.
Euno
An enterprise context platform, raising $23M so AI systems can make decisions against institutional knowledge rather than guesses.

WeeklySection 02 · Frameworks & Failures

Frameworks

Four controls that would have stopped this week’s attacks

The two attacks in story 01 are not clever. They work because the industry shipped agents that read untrusted files and act on them, then left the gate off. Meta’s design points at what the gate looks like, and none of it requires waiting for a vendor. One: treat every file an agent reads as untrusted input, including vendor documentation, README files and llms.txt. Data your agent reads is code your agent may run. Two: put something between the agent and the network that approves outbound actions, whether that is an egress proxy, an allowlist or a human. Three: run agents with credentials they cannot read, the way Muse uses secrets it never sees, and never in a shell holding your production cloud keys. Four: pin and mirror your package sources, so an agent inventing a plausible package name cannot reach a public registry and pull a stranger’s code into your build. The uncomfortable part is that most teams have adopted agents faster than any of this.

Why it matters: Start with egress. Most agent damage this week required the agent to reach a network it should never have reached unsupervised. Audit what your coding agents run at startup, not just what they do when prompted. GitSpawn fired before anyone typed anything.

Failures & Data

A patched flaw became a live attack in four days

JFrog patched CVE-2026-82329 in Artifactory on 28 August, an authentication bypass rated 9.8 that lets an unauthenticated attacker on the network mint administrator tokens. By 1 September, watchTowr was watching it be used in the wild, with attackers forging admin access and enumerating users, groups, credentials and federated trust relationships. Their analyst put it plainly: this “moved from disclosure to real-world exploitation with uncomfortable efficiency.” Artifactory is where a great many organisations keep the packages their builds install, so a compromise there reaches every downstream build. JFrog’s own cloud instances were patched for customers. Self-hosted deployments were not, and those are the ones being hit.

Failures & Incidents

GitSpawn: eight flaws across seven AI coding agents (Sep 2)
A repository can name the program Git runs via core.fsmonitor, executing attacker code when an agent gathers context. Goose, Cursor and Codex are fixed; Hermes, Qwen Code and Grok Build were not at publication, and one Claude Code path remained open.
Manifold Security
Published llms.txt files pointing at unregistered packages (Sep 4)
120 found across 6,214 scanned domains. Registering one produced a callback from a Fortune 500 network within an hour, with Claude, Codex and Hermes identified in the process chain.
Schneier on Security
JFrog Artifactory CVE-2026-82329 exploited in the wild (Sep 1)
Patched 28 August, weaponised four days later to forge administrator tokens. Self-hosted instances remain the exposure.
watchTowr, via The Hacker News

Hiring & Trends

He built Palo Alto Networks. Investors just gave him $245M for a product that does not exist.

On September 8, Cylake closed $245M on a convertible note from Lightspeed, Picture Capital and Redpoint, taking it to $290M raised. There is no product yet. Beta is due at the end of 2026 and general availability in 2027. What investors are buying is the founder and the thesis. Nir Zuk founded Palo Alto Networks in 2005 and was its CTO for two decades before leaving last August; he started Cylake at the beginning of this year with Wilson Xu and Ehud Shamir, emerging from stealth in March on a $45M seed. The thesis is sovereignty: an AI-native security platform that runs on-premises or in a private cloud, for governments, banks and regulated institutions that cannot send security telemetry to someone else’s cloud. Read alongside Meta’s Confidential VM, a theme appears. The premium product in AI is increasingly the one that can prove your data never left.

WeeklySection 03 · Editor’s Note

By the Numbers · The AI quality gap, quantified

QAble Weekly analysis · sources per figure

AI coding agents found vulnerable to GitSpawn, including Claude Code, Codex, Cursor and Grok Build

Source: Manifold Security, via The Hacker News, Sep 2

6,214

domains scanned in a separate study, turning up 120 llms.txt files pointing at unregistered packages

Source: Schneier on Security, Sep 4

1 hour

from registering one of those abandoned package names to a callback from a Fortune 500 network

Source: Schneier on Security, Sep 4

$245M

raised by Cylake on a convertible note, with a beta not due until the end of the year

Source: GlobeNewswire, Sep 8

Editor’s Note

Viral Patel, Co-Founder of QAble — Viral PatelCo-Founder, QAble

“Meta shipped a consumer assistant this week with an isolated machine, a separate approver for every outbound action, and card numbers that only work once. The coding agent your team ran today had none of those things.”

What sits between your coding agent and the open internet right now?

Two research teams published within days of each other, and found the same hole from different angles.

One showed that a repository can tell Git to run a program, and that AI coding agents run Git the moment they open a folder. Nobody types anything. The other scanned six thousand company websites and found a hundred and twenty published documentation files pointing at software packages that did not exist. They registered one, and a Fortune 500 network contacted them within the hour, having installed it.

Neither is sophisticated. Both work for the same reason: we built tools that read files and act on them, and then we forgot that reading is not a safe operation when the reader can execute.

What makes the timing sharp is that Meta launched a consumer agent in the same week and clearly assumed from the start that people would attack it. Its agent runs on its own machine. A separate watcher has to approve anything that touches the internet. It can use your saved passwords without being able to see them. It pays with card numbers that die after one purchase.

That is not because Meta is unusually wise. It is because a consumer product that leaks a customer credit card becomes a headline, while a developer tool that leaks a cloud key becomes an incident ticket. The incentives produced the gate in one place and not the other. Your engineering organisation is running the ungated one, and probably on machines that hold production credentials.

The fix is not exotic. Assume every file an agent reads is trying to instruct it, and put something it does not control between it and the network. Both attacks this week die at that second step.

WeeklySection 04 · Briefing

Funding & M&A

The Exploration Company $450M · Series C
Cylake $245M · Convertible note
Bluecore Energy $50M · Seed

Research

GitSpawn
Manifold Security’s disclosure of eight flaws across seven coding agents, all with one root cause: agents run Git commands for context before neutralising repository-controlled configuration.
Agent Data Injection Attacks are Realistic Threats to AI Agents
Published in July, it named this exact failure and predicted remote code execution on coding agents, concluding that current agents do not isolate trusted data from untrusted data.

Quote of the Week

“This moved from disclosure to real-world exploitation with uncomfortable efficiency.”

watchTowr, on CVE-2026-82329

Market Signals

01Two independent disclosures in one week showed AI coding agents executing attacker-controlled input with no user action, which makes it a category problem rather than a vendor bug.
02Patch windows for internet-exposed critical flaws are now measured in days: JFrog went from fix to in-the-wild exploitation in four.
03Consumer agents are shipping with stronger containment than developer agents, which is the reverse of how security usually arrives.
04Data sovereignty is funding platforms years ahead of product, with $245M going to a pre-beta security company on that thesis alone.
05The gap to close is not agent capability, it is the absence of anything standing between an agent and the network.