Sandboxes and Permission Modes Versus Repository-Borne Attacks: What Three Reports on AI Coding Agents Show About Where Defenses Apply
Reports on GitSpawn, Plugin4Shell and IssueTrojanBench place attacks before, outside or inside the boundaries that Copilot sandboxing and Claude Code permission modes describe.
Background
Two kinds of control now sit between an AI coding agent and a developer’s machine. One decides whether the agent asks before acting. The other limits what an action can reach once it runs. Claude Code’s documentation draws that line directly: “Permission modes decide whether Claude asks before an action, and the Bash sandbox and outer isolation boundaries decide what an action can reach once it runs,” according to the Claude Code permission-modes documentation. The same page says that with Claude Code v2.1.283 or later, auto mode, in which a second model reviews actions instead of the user, is the built-in starting permission mode for interactive terminal and VS Code sessions. It also says that “Auto mode reduces permission prompts but does not guarantee safety.” Administrators can remove the mode by setting permissions.disableAutoMode to "disable" in managed settings, per the same documentation, which the Herald read on October 24, 2026.
GitHub describes the other control in its changelog entry announcing general availability of local sandboxing for Copilot, covering the Copilot CLI, the Copilot app and VS Code sessions using Agent Host. GitHub says tools and commands initiated by Copilot “run with restricted access to the filesystem, network, credentials, and other system capabilities, based on policies defined by the developer or their organization,” that enterprise-managed settings can “require sandboxing and enforce policies that developers cannot weaken,” and that it is included at no additional cost. The entry adds that “Model execution and tool isolation are separate concerns.” The Herald covered the preview of the Copilot app sandbox and its move to general availability earlier.
Both descriptions come from the vendors that ship the controls. Three outside reports, published between July and September 2026, describe attacks against coding agents at different points relative to those controls.
Current situation
Commands that run before or outside the controls. The Hacker News reported on September 2 that Manifold Security disclosed eight security flaws across seven command-line coding agents, in which a repository’s own Git configuration names a command that the agent runs. According to the outlet, the command “executes as the user, outside the agent’s sandbox and without an approval prompt,” and exploitation requires the repository to arrive as files with its .git directory intact, as with a shared archive, a shared drive, a sync folder or a USB stick, whereas an ordinary clone does not. The outlet reported that on Claude Code and Hermes Agent the payload fires before the workspace-trust prompt is accepted, and that four of the eight were unpatched at publication. Cyber Security News, a separate outlet, described the same disclosure, saying the command runs “outside the sandbox and completely invisible to any permission system.” The Hacker News reported that no source reports exploitation of any of the findings, and that it found none of the CVEs in the CISA Known Exploited Vulnerabilities catalog on September 2. The Herald’s earlier report covers the disclosure itself.
Install-time checks that did not verify what they installed. The Hacker News reported on September 18 that security firm Air Security found a flaw in four coding agents in which the owner of a plugin’s repository can swap the code an agent installs even when the plugin is pinned to a specific commit hash. The outlet wrote that Air found “that the agents fetch that snapshot but never check that the code they end up with actually matches it.” Per that report, the trick does not work against GitHub-hosted plugins, because GitHub does not allow branch or tag names that look like commit hashes, but it does on hosts that permit them, such as Bitbucket or a company’s own git server. The outlet reported that Air says Anthropic patched the flaw in Claude Code 2.1.179, that OpenAI fixed it in Codex 0.146.0, that GitHub Copilot has no fix, and that Google will not patch the Gemini CLI. It added that “no marketplace can fix this for users” because each agent checks the lock on the user’s own machine, and that there was no sign of use in a real attack. The article also notes that its sources do not say whether updating removes a plugin that was already swapped.
Injected instructions inside the permitted workspace. A preprint on arXiv, IssueTrojanBench, submitted on July 22, 2026 and not described as peer reviewed on its landing page, tested Cursor, Claude Code and Codex Desktop, powered by GPT-5.3 Codex, GPT-5.4 and Sonnet 4.6, against malicious instructions embedded in issues, PDFs, comments and other delivery vectors. The authors report that a range of 41.1% to 79.2% of the malicious issues penetrated every guardrail, with Codex Desktop averaging 79.2% and Claude Code 41.1%, and attribute the variation to the models each agent supports rather than to the agents. In their attribution of 1,400 runs that agents resisted, none (0 of 1,400) were attributable to framework-level defenses, and they write that Codex Desktop’s OS-level sandboxing, command approval policies and network isolation “contributed no observable rejections, as all workspace-scoped attacks that passed the model’s safety filter were executed regardless of the framework.” The tests ran on a local machine using forked repositories, and the paper says no pull requests were submitted to real repositories. The Herald’s coverage of the study gives further detail.
Implications
The following is analysis drawn from comparing the sources, not a finding of any one of them.
The reports sit at different layers. In the GitSpawn reports, the attacker-chosen command runs before the trust prompt or outside the sandbox, so a sandbox or permission mode that governs actions after launch is not the layer at issue. In the Plugin4Shell report, the failure is a missing integrity check at install time, which neither a sandbox nor an approval mode is described as performing. In IssueTrojanBench, the actions at issue fall within the workspace the agent is permitted to use, and the authors report that Codex Desktop’s sandboxing contributed no rejections. The vendor descriptions of sandboxing and auto mode, read next to these reports, therefore cover a different part of the attack surface than any of the three describe. None of the reports evaluates Copilot’s sandbox or Claude Code’s auto mode, and they do not say those controls would fail against the attacks described.
Configuration that arrives with a repository is an input. Two of the three reports concern material that travels with a project: a .git/config file in the first, a plugin source in the second. The Hacker News lists checks users can run, including inspecting .git/config for core.fsmonitor in any repository received as files, and advises that vendors shipping agents strip the setting on background calls, for example with git -c core.fsmonitor=false status.
Patch status varies by agent and by report. The Hacker News reported four of eight GitSpawn findings unpatched on September 2 and Copilot without a fix for Plugin4Shell on September 18. Those are the dates of the reports; the Herald did not re-check vendor status afterward, so current status may differ.
Enterprise controls reach some of this. The GitHub and Claude Code pages describe managed settings that can require sandboxing or remove auto mode. By The Hacker News’s account of Plugin4Shell, the pin check has to ship in the agent itself, so a managed setting is not described as substituting for an update.
Open questions. The sources do not say whether a managed sandbox would have contained the GitSpawn commands, which the reports place outside the sandbox. They do not say how models released after those tested perform on IssueTrojanBench. The Hacker News reported that a second Claude Code path, reached through claude ultrareview, was confirmed live on version 2.1.252 on September 1 against the then-current release 2.1.258, and wrote that no source states whether subsequent releases have closed it.