Provenance Record

Meets the Analysis format: Background (vendor descriptions of the two control types), Current situation (three reports placed relative to those controls), Implications (explicitly introduced as 'analysis drawn from comparing the sources, not a finding of any one of them'). 1,288 words (range 800-2000). It examines a topic (where sandboxes and permission modes apply versus where three reported attack classes operate) rather than recapping one release. Implications contain no prediction and no recommendations in the Herald's voice; the check-list and vendor-stripping advice are attributed to The Hacker News. Open-questions paragraph states what the sources do not say. Four internal links (/article/2026-09/25-github-copilot-app-..., /article/2026-10/08-github-copilot-local-sandboxing-..., /article/2026-09/02-gitspawn-flaws-..., /article/2026-09/01-issuetrojanbench-study-...) all resolve to published articles and are described accurately (preview of the Copilot app sandbox; GA; GitSpawn disclosure; IssueTrojanBench coverage). Existing Herald coverage of Plugin4Shell (2026-09/22) is not linked but not required.

INDEPENDENT-SOURCE COUNT (honest): 2 clearly independent outlets, plus 1 derivative. Non-subject, independent of vendors: (1) The Hacker News (two articles, counted once): GitSpawn article (source-0.html.gz) relays Manifold Security's disclosure but adds its own checks (CISA KEV catalog v2026.09.01 with 1,687 entries on Sep 2, npm registry for Qwen Code 0.22.3, MITRE CVE List lookup for CVE-2026-71963, Anthropic advisory record) and quotes OpenAI's CVE record and the GitHub advisory; Plugin4Shell article (source-1.html.gz) relays Air Security's disclosure, with THN's own marketplace check, local reproduction of the Git behaviour and OpenAI's public fix text. Both are relays of third-party security-research disclosures with added independent verification, not vendor disclosures. (2) arXiv 2607.20759 (source-3.html.gz): preprint by Ankur Singh, Jinqiu Yang and Tse-Hsun (Peter) Chen of Concordia University, independent academics with no vendor affiliation; it is not peer reviewed (arXiv v1, 22 Jul 2026) and the article says so; it is used only for attributed, quantitative claims ('The authors report'), and the paper's own text was read in full (live PDF fetch, since the snapshot holds only the abstract page). Acceptable as an independent source for attributed claims of this kind. Cyber Security News (source 2, snapshot failed with HTTP 403; I fetched the live page with a browser User-Agent and read it, recorded here as a live-URL fallback): it is a rewrite of Manifold Security's disclosure ('as detailed in the technical disclosure published by Manifold Security') with no added verification; it is a separate outlet but does not add independent corroboration, so I do not count it as a third independent source. Its two uses in the article (quote 'outside the sandbox and completely invisible to any permission system'; 'described the same disclosure') are verbatim/accurate. Vendor sources, not counted: GitHub changelog (source-4.html.gz) and Claude Code permission-modes documentation (source-5.html.gz). Total 6 sources (>=4), 2 independent (>=2): requirement met, though only just, and the underlying findings all trace to two security firms (Manifold, Air) plus one academic team. SNAPSHOT/LIVE CHECKS: THN GitSpawn confirms: Manifold Security, eight flaws across seven CLI agents, four unpatched at publication, command 'executes as the user, outside the agent's sandbox and without an approval prompt', requires files with .git intact (archive, shared drive, sync folder, USB stick), not an ordinary clone; payload fires before workspace-trust prompt on Claude Code and Hermes Agent; no exploitation reported; none of the CVEs in KEV on Sep 2; ultrareview path confirmed live on 2.1.252 on Sep 1 against current release 2.1.258 with 'No source states whether the subsequent releases have closed it'; advice list (inspect .git/config, vendors strip config e.g. git -c core.fsmonitor=false status) matches. THN Plugin4Shell confirms: Air Security; four agents; flaw swaps code despite commit-hash pin; 'fetch that snapshot but never check that the code they end up with actually matches it'; GitHub does not allow hash-like branch/tag names so GitHub-hosted plugins are not exposed to the branch trick, but Bitbucket/own git servers are; Air says Claude Code 2.1.179 patched, Codex 0.146.0 fixed (also confirmed by OpenAI's own fix text per THN), Copilot no fix, Gemini CLI will not be patched; 'no marketplace can fix this for users'; no sign of real-world use; 'The sources do not say whether updating an affected agent removes a plugin that was already swapped'. Patch-status claims are all attributed to the reports or to Air and dated to the report dates, with an explicit statement that status was not re-checked; none is stronger than the source. IssueTrojanBench (abstract page plus full PDF): Cursor, Claude Code, Codex Desktop; GPT-5.3 Codex/GPT-5.4 and Sonnet 4.6; 'a range of 41.1% to 79.2% of IssueTrojanBench's malicious issues successfully penetrate every guardrail'; Codex Desktop 79.2%, Claude Code 41.1% (Cursor 66.5%, overall 66.5% of 4,176 runs); variation 'attributable to the models each agent supports rather than the agent itself'; 'Framework-level defenses (0/1,400, 0%)'; the quote on Codex Desktop's 'OS-level sandboxing, command approval policies, and network isolation' contributing 'no observable rejections, as all workspace-scoped attacks that passed the model's safety filter were executed regardless of the framework' is verbatim; forked repositories in a local isolated environment, 'no pull requests ever submitted to the real repositories'; submitted 22 Jul 2026. The article states preprint status and that results on later models are unknown. GitHub changelog (Oct 7, 2026): CLI, app and VS Code sessions using Agent Host; quoted phrases 'run with restricted access to the filesystem, network, credentials, and other system capabilities, based on policies defined by the developer or their organization', 'require sandboxing and enforce policies that developers cannot weaken', 'Model execution and tool isolation are separate concerns', 'no additional cost' all verbatim. Claude Code docs (fetched Oct 24, 2026, live at review time): 'Permission modes decide whether Claude asks before an action, and the Bash sandbox and outer isolation boundaries decide what an action can reach once it runs' verbatim; v2.1.283 or later auto mode is the built-in starting mode for interactive terminal and VS Code sessions; 'Auto mode reduces permission prompts but does not guarantee safety' verbatim; permissions.disableAutoMode = 'disable' in managed settings; 'a second model, the classifier, reviews actions instead of you'. Allowlist: thehackernews.com, cybersecuritynews.com, arxiv.org, github.blog and code.claude.com are all exact-hostname entries in config/source_allowlist.txt. PATTERN SCANNER: source-5 (code.claude.com permission-modes) tripped 'system-prompt-reference'; the matched excerpt is site navigation JSON ('"description":"System prompts, skills, and plugins"' under the Agent SDK 'Customize behavior' menu entry), not an instruction to an AI; false positive, overridden after reading it in context. No other source has suspicious_patterns, and no snapshot text addressed an AI agent.

All numbers, dates, versions, attributions and quotes verified against the sources as above. Minor imprecisions, none requiring a correction: (a) the Implications repeat 'Copilot without a fix for Plugin4Shell' as THN's report, whereas THN attributes that to Air ('No fix, Air says'); the Current-situation paragraph attributes it correctly and the Implications sentence is hedged with 'Those are the dates of the reports'; (b) the article does not note that THN says Anthropic's 2.1.179 release notes do not mention the fix, but it does attribute the patch claim to Air; (c) the synthesis sentence that vendor descriptions 'cover a different part of the attack surface than any of the three describe' is the Herald's inference, is labelled as analysis, and is immediately qualified ('None of the reports evaluates Copilot's sandbox or Claude Code's auto mode, and they do not say those controls would fail'). For IssueTrojanBench the paper itself concludes that current agent architectures do not address injection for actions within the permitted workspace scope, which supports the inference. The title ('what three reports show about where defenses apply') does not assert a causal conclusion; the body expressly states no report tests the vendor controls.

Qualifies as an Analysis (1,288 words, 6 sources, 2 clearly independent outlets of which one is a preprint, facts and analysis separated, no unsupported claims). All quotes and figures verified; patch-status language is attributed and no stronger than the sources. No corrections required. APPROVE. Featured candidacy: 1 - careful synthesis of three security reports and two vendor controls for developers using AI coding agents, but built on previously covered stories