AI News Briefing — Malicious git configs run code in coding agents

Coding agents

[2026-09-02] Manifold Security disclosed GitSpawn: eight flaws across seven CLI coding agents where a repository’s own .git/config runs attacker code before the agent contacts a model. Nearly every agent runs git status or git diff at startup to gather context, and git executes core.fsmonitor from the repo it just entered. GitHub’s advisory for Copilot CLI (CVE-2026-45033, CVSS 8.5) names fifteen-plus further keys — core.hookspath, diff.external, merge.tool — and fixes it in 1.0.43 by setting safe.bareRepository=explicit. goose patched in 1.44.0; four issues were still open at publication. (advisory, source)

Cloning a repository to read it has been safe for long enough that nobody lists it as an action with consequences. Nothing here needs prompt injection or a model in the loop — the agent runs git status and git does the rest.

For Security Engineers: Pin Copilot CLI to 1.0.43 and goose to 1.44.0 on developer machines and CI images now. For the four still open, exposure starts the moment a repository lands on disk, so the control is where clones come from rather than what the agent is allowed to do afterwards.
[2026-09-02] GitHub made content exclusions generally available in the Copilot app and CLI, so enterprise, org and repo admins can keep named files out of an agent’s context. Business and Enterprise only. The same day, enterprise-managed settings gained the ability to pin any model as the default rather than a short approved list. (official)

Exclusions keep a file out of the context window, not off the disk — the agent still works in a checkout that contains it.

For Solution Architects: Admins can set these at enterprise, org and repo level, so the workable pattern is a narrow enterprise baseline — credential fixtures, .env samples — plus per-repo additions the owning team maintains. Business and Enterprise plans only, so Individual seats in a mixed org need a different answer.

Model releases

[2026-09-02] Google shipped Gemini 3.8 Flash and a defence-only sibling, 3.8 Flash Cyber — its third Flash model in six weeks. Introductory pricing is $0.75 per million input and $3.50 output through December 31, then doubles to $1.50/$7.50. Google is candid that 3.8 Flash “works harder”: more reasoning steps and more tool iterations per task, so the per-token price drop does not automatically mean a cheaper task. Flash Cyber clears 70% real-world vulnerability discovery across 20 languages and 47.2% pass@1 on CWE-Bench. (official, source)

Three Flash releases in six weeks outruns most teams’ evaluation cycle — whatever you pinned in July is two versions behind, and the December 31 cliff sets the date by which that decision has to be revisited anyway.

For Engineering Managers / Tech Leads: A migration costed at $0.75/$3.50 is really a January bill at $1.50/$7.50, so run the numbers on both. Measure tokens per completed task rather than per call — extra reasoning steps and tool iterations are where the difference hides.
[2026-09-02] Flash Cyber is not on general sale. It reaches defenders only through the Fairwind Program, bundled with CodeMender for verified patches, and applicants have to keep access inside their security, incident-response or pentest teams. Google names 650-plus partners including CrowdStrike, Palo Alto Networks, Wiz and Snowflake. (official)

Applying is the only route in, and the bar is a team you have to name rather than a plan you can buy. Most security groups will read about this well before they can use it.
[2026-09-02] Meta released Muse Spark 1.3 to its API and Muse Code CLI, claiming roughly 20% fewer tool calls and 25% fewer tokens than 1.2 for the same work — the model asks clarifying questions and confirms consequential actions instead of burning turns guessing. Artificial Analysis puts it trading blows with GPT-5.6 Sol and Opus 5. A contributor tier prices input at $0.10 per million, cached input at $0.002, in exchange for training rights and lower rate limits. Zuckerberg promised open weights “soon” with no date. (source)

Fewer tool calls and fewer tokens for the same work is a claim your own traces can settle in an afternoon, unlike a benchmark position. Do that before the $0.10 contributor tier tempts anyone — training rights are the price, and that is a legal question rather than a procurement one.

Agent frameworks & interop

[2026-09-03] LangChain published what Schneider Electric, Vodafone and monday.com learned running agents at scale. Schneider has 350 people supporting 60-plus agents behind an assistant serving 160,000 employees in 107 countries. The finding worth stealing is monday.com’s: adding tools made their Sidekick agent less capable, and the fix was splitting one reasoning loop into subagents with bounded responsibilities. (source)

350 people supporting 60-plus agents is the number nobody puts in a business case — roughly six people per agent, at an organisation that evidently considers it worth paying for.

AI cost tracking & telemetry

[2026-09-02] GitHub published the arithmetic behind cutting Copilot’s agent bill, and every item is small: compressing repetitive build and test log noise while leaving git diff output untouched (5.5%), dropping unused line-number prefixes from the file viewer (3–5%), halving the task-tool prompt for 1,300 fewer tokens a turn (2.9%), batching background-task results (2.3%). Their counter-intuitive result: trimming individual tool outputs raised total cost, because the agent spent turns recovering what had been cut. (official)

None of this needed a cheaper model. Log-noise compression and prompt trimming are changes a platform team can make on its own, and single-digit percentages compound when they stack.

Practice & craft

[2026-09-02] Rachel Laycock argues the review queue broke because volume moved, not because review got worse — Meta reports 106% more lines per human-landed diff in a year and DX has median PR size up 64%. Her alternative is not automated review but moving judgement earlier: pairing, design sessions, fitness functions encoding architectural constraints, and review by exception for security boundaries and unfamiliar critical systems. (source)

Review by exception needs a written list of which boundaries and which systems, or it quietly becomes reviewing nothing. The volume half is easy to reproduce in your own repo: lines per landed diff, this year against last, before anyone argues about whether review is broken.
[2026-09-02] Vercel treats its agent guidance file as software with a test suite. design.md took over 200 agent runs to build, and a weekly loop folds Slack, GitHub-review and Figma feedback into proposed edits. In a controlled six-page test, pages built with the file carried 39 mechanical failures against 91 without — 57% fewer, on a sample small enough to read as a direction rather than a rate. (source)

Two hundred agent runs to build one guidance file is the cost line teams skip when they decide to write an agents file this sprint. The weekly loop folding review comments back in is what stops it going stale, and that part copies without any of Vercel’s tooling.
[2026-09-02] The Claude cookie theft has a second half: a stolen session inherits the OAuth grants a personal Claude subscription holds against corporate Google Workspace or Microsoft 365. No Claude tenant admin can sign that account out, and the Workspace or Entra admin who could pull the grant usually does not know it exists. Signing sessions out does not revoke the grant — that is a separate action, and worth auditing before the next infostealer alert. (source)

Workspace and Entra both list third-party app grants per user. That report is the inventory, and it belongs to an admin who has probably never been asked for it.

Teaching & learning

[2026-09-02] New York City barred student-facing generative AI and companion chatbots from 2-K through eighth grade for a year — roughly 600,000 students, about two-thirds of the district. High schoolers keep a limited slate of tools plus an “AI critical thinking” course; students with disabilities and English learners are exempt. Screen time on individual devices is capped at 30 minutes for grades 3–5 and 45 for middle school. (source)

Twelve months reads as a review window rather than a settled position. The detail worth carrying is the exemption: the same tools ruled out for everyone else are accommodations for students with disabilities and English learners.

Research worth reading

[2026-09-02] SkillShift embeds a hidden objective inside a reusable agent skill that keeps its declared interface working perfectly. Attacker-favoured choices won 81% of commerce decisions and 63% of software-dependency picks, with full task utility preserved, transfer across model backends without re-tuning, and no detection by current skill scanners. Third-party skills are a supply chain you are not currently scanning. (paper)

Passing the declared interface is exactly what a skill’s tests check, so the tests stay green. A preference shift leaves no failing assertion behind — what you would need is provenance, not a better scanner.
[2026-09-02] EarlyEval halts an agent evaluation run as soon as a pair of LightGBM classifiers predicts the outcome from behaviour so far. Across three benchmarks it cut execution steps 13–26% and input tokens by up to 44%, at 89–97% prediction accuracy and a 1–2 point shift in measured resolve rates. Eval harnesses are usually the cheapest place to claw back agent spend. (paper)

A 1–2 point shift in measured resolve rate is the trade on offer, and whether that is acceptable depends on whether your evals rank models or gate a release.

Watch list

The four GitSpawn agents still unpatched. Manifold named Cursor CLI, Qwen Code, Grok Build and Hermes Agent among the affected set, and Anthropic has published no advisory for Claude Code. A vendor release note or a GHSA entry per tool is what closes this.

A GHSA entry is the artefact to wait for. Release notes for CLI tools are inconsistent enough that a quiet fix and no fix look identical from outside.
Meta’s Muse Spark open weights. Zuckerberg said “soon” on X with nothing behind it. Weights on Hugging Face, or a post on ai.meta.com naming a licence, would make it real; another flagship shipping API-only first would say the opposite.

Hugging Face is where this becomes real. A post costs nothing to write and “soon” carries no expiry date.
Nvidia and Hugging Face. Bloomberg had the deal closing this week at $14 billion. Still no filing as of today, and the useful signal is whether an 8-K arrives before a fourth price leak does.

This week was the closing window the reporting named, so the item either resolves within days or the timeline was wrong.
Grok 4.7, claimed for around September 12. Nine days out and x.ai/news still has nothing. The date came from Musk, not from the company, and a release note is the only thing that would change that. (unconfirmed)

Nine days is short enough that docs or a landing page usually appear ahead of a launch. Should nothing show up on x.ai/news by around the 10th, the date is a claim rather than a schedule.