For two years the argument about AI coding assistants has been about what they write. The first week of September moved it to something duller and more immediate: what they read. On 2 September the research firm Manifold Security disclosed a class of flaw it calls GitSpawn — eight separate issues across seven command-line coding agents, among them Claude Code, OpenAI's Codex, Cursor, Block's goose, Qwen Code, Grok Build and Hermes Agent. The common thread is not the models. It is Git.
The mechanism is almost disappointingly plain. Git has a configuration setting, core.fsmonitor, that exists for speed: it names a command the tool should run to find out which files have changed, so that large repositories do not have to be scanned in full. The setting lives inside the repository, in its own .git directory. Coding agents, meanwhile, run Git as a matter of course when they open a workspace — to work out the branch, the diff, what the user has been doing. So an agent pointed at a hostile repository executes the command that repository nominates. Manifold's finding is that this happens at startup, with the user's own privileges, outside whatever sandbox the agent maintains, and — the detail that matters most — before the workspace-trust prompt that is supposed to be the moment of consent. The question "do you trust the authors of this folder?" arrives after the answer has already been acted on.
What an attacker gets is what the user has: in Manifold's description, the ability to read, change or delete the user's files and to reach the other resources that account can reach — which, on a developer's machine, tends to mean cloud credentials, signing keys and source control. Vendors moved at different speeds. Fixes shipped in goose from version 1.44.0, in Claude Code from 2.1.196, and in Cursor. As of 1 September, Manifold listed Hermes Agent, Qwen Code and Grok Build as unpatched, along with a second exploit path into Claude Code. Identifiers were issued for several: CVE-2026-72718 against goose, rated only 4.0, CVE-2026-19592 against Codex with three further identifiers covering its variants, and CVE-2026-71963 against Hermes Agent by way of VulnCheck.
Two caveats deserve as much prominence as the finding. No exploitation in the wild has been confirmed. And the attack needs the repository to arrive as intact files with the .git directory preserved — a downloaded archive, a shared folder, a supply-chain artefact — rather than a normal git clone, which does not carry a stranger's local configuration across. That narrows the blast radius considerably, and anyone reporting this as "your AI assistant can be hijacked by any repo" is overstating it. What it does not narrow is the lesson. The industry spent two years building trust prompts, sandboxes and permission models around the model's output, and this class of bug walks in through the tooling underneath, which nobody thought of as attack surface because it has been sitting there since 2005.
A hijacked route, a poisoned update, a root shell
Attackers announced someone else's network path and used it to poison a software update. According to reporting on 1 and 2 September, a BGP hijack was used to intercept traffic bound for Softaculous, the company behind the widely deployed Virtualizor hosting control panel, and to serve a malicious package in place of the genuine one. Hosting providers that took the update handed over persistent root access to their hypervisors — the layer beneath every customer virtual machine on the box. It is a compact demonstration of two weaknesses compounding: routing that still largely runs on trust, and update channels that authenticate the transport rather than the payload. The internet's routing layer has been the subject of hardening proposals for two decades; the practical defence available to an operator today remains signed packages and a checksum verified out of band. That this attack reached the hypervisor rather than a single application is what separates it from an ordinary supply-chain incident: the compromise sits below anything a tenant can inspect.
An old botnet dismantled, an old campaign charged
Two enforcement actions landed on the same day, both aimed at infrastructure rather than incidents. International law enforcement, working with private-sector partners, seized the infrastructure of Sality, a peer-to-peer botnet that has been part of the malware landscape since the middle of the 2000s and whose decentralised design was specifically intended to survive the loss of any single server. Separately, United States prosecutors charged an extradited Russian national over a phishing campaign that ran in 2016 and 2017: by the government's account, some 255 fraudulent accounts were used to send malware-bearing Excel files to roughly 80,000 recipients, distributing the TVRAT and DarkVNC remote-access tools, with freelancers among the intended victims. The charges are allegations and have not been tested at trial. The pairing is a fair picture of the trade: takedowns arrive quickly and indictments arrive a decade later, and the second is usually the one that removes a person from the field.
Eight hours, $535, one ported exploit
The month's most useful AI result was an honest negative. Forescout's Vedere Labs published an experiment on 1 September in which it used Claude — starting on Sonnet 4.6 and moving to Opus 4.6 — to port a working exploit for CVE-2021-31886, a pre-authentication stack overflow in the Nucleus FTP server, from one WAGO programmable logic controller to another, the 750-852 to a 750-831 running firmware V01.04.16. It worked: the model found that changing the command sequence from USER and QUIT to USER and CWD, while omitting the line terminators that would cause normal processing, preserved the shellcode, and two payloads ran on live hardware. It took eight hours and thirty-two minutes and $535.74 in API charges. The researchers' own conclusion is the part worth keeping: a competent human could probably have done it faster, cheaper, and without crashing the controller. Machine-speed exploitation is coming; on this evidence it has not arrived. WAGO has no fix, and CERT@VDE advises disabling FTP on port 21 and segmenting the network.
The defenders' own week of trouble
The endpoint industry spent the turn of the month on the wrong side of several stories. SonicWall warned that two previously unknown flaws in its SMA 1000 remote-access appliances were under active attack and could be chained, one granting pre-authentication access and the other code execution — the security appliance again serving as the way in. Microsoft investigated its own false positive, with Defender for Office 365 flagging legitimate Google search links as malicious, the sort of failure that costs a product more credibility than a missed detection. Researchers counted close to 22,000 Exchange servers still exposed to an authentication bypass affecting every mailbox on them, months after a patch existed. Phishing campaigns were seen abusing Faronics Deploy, a legitimate endpoint-management tool, to install ScreenConnect — administration software as the payload, a pattern this magazine has recorded in nearly every year of its archive. And PaperCut flaws patched only days earlier were already being used for data theft.
🔍 How this issue was reported
Aegis Sentry does not have reporters in the field. This issue was assembled on 2 September 2026 from published trade reporting — principally The Hacker News and BleepingComputer — and from the disclosing parties' own material where it was available: Manifold Security on GitSpawn, Forescout's Vedere Labs on the exploit-porting experiment, SonicWall's advisory, and CERT@VDE's guidance for the WAGO controllers. Where a figure comes from one party rather than from independent confirmation, we have named that party in the text. Criminal charges described here are allegations. Nothing in this issue has been verified by us at first hand, and where later reporting corrects it we will correct it here.