supply-chain

3 posts · all tags

  • GitSpawn: How a .git Folder Can Run Code Before Your AI Agent Asks Permission

    AI coding agents run git commands in the background all the time. Not because you asked — because git status and git log are how the agent figures out what it’s looking at when it opens a project. No approval prompt, because they’re “just reads.”

    Manifold Security showed that assumption is wrong. A project folder can carry a .git/config line that turns the agent’s very first orientation step into arbitrary code execution — before the workspace-trust prompt, outside the agent’s sandbox, running with your own user permissions. They call the bug class GitSpawn, and it hit seven AI coding tools, including Claude Code, Cursor, and Codex.

  • Agent Skills Are a Supply Chain, Not a Config File

    A skill looks like documentation. It is a folder with a Markdown file in it, and installing one is git clone or a drag into a directory. Nothing about that gesture feels like adding a dependency.

    It is adding a dependency. The file tells your agent what to do, and it does it with whatever privileges you already granted — with none of the review you would give a package that arrived through a lockfile.

  • Your CI Pipeline Is the Softest Target You Own

    Your production database has a WAF, an audit log, and a quarterly review. Your CI runner has a copy of the credentials to it, executes arbitrary code from every branch, and has never once been threat modeled.

    Attackers noticed this asymmetry years ago. Build systems are where the secrets are, and unlike production, nobody is watching them.