CLAIM-2026-09-06-04
The execution happens as the user, with the user's privileges, outside the agent's sandbox and before any approval or workspace-trust prompt: 'The permission model never sees it.'
Why it matters
Every agent risk assessment that names the approval prompt as its mitigation is wrong for this class. The prompt is downstream of the execution.
Sources
- manifoldsec2026gitspawn