core.fsmonitor

Seven AI coding agents run attacker code named in a repository's own .git config

Manifold Security reported eight instances across seven command-line agents. The command runs as the user, outside the sandbox, with no approval prompt, and four were still firing when the researchers retested on September 1.