Pattern: the repository folder itself has become the trust boundary agents are now defending

arXiv·high signalXBlueskyLinkedInCopy link

Three independent items in 48 hours all police what a checked-out directory is allowed to make an agent do: GitSpawn's core.fsmonitor RCE across seven agents, arXiv 2609.03884 on attacker-controlled lifecycle-hook updates, and Cline shipping a deliberate refusal to load `.agents/plugins` from the workspace. The shared shape is that agent harnesses read repo-local configuration (git config, hook definitions, plugin manifests) with host privileges before any human approval step runs. If you maintain a harness, enumerate every repo-local file it reads at session start and ask which of them can name a program.