Manifold Security

In July our research team found 77 fake code editor extensions. Nineteen of them stole logins for code repos and build pipelines. That was one campaign, and about 15 new reports like it land every day. So we built Threat intelligence into Manifold: one feed, ranked by what to act on first. It's live now. https://mnfld.se/thin-k7m

The controls enterprises run in the browser answer one question: should the site load or extension install? Enterprise browsers, gateways, DNS filters, extension allowlists. They decide at the door, then stop watching. An AI agent's risk starts after that decision. When Claude in Chrome or GPT-6 Astra operates the browser, it works inside the session with the employee's signed-in identity. It reads email, clicks into approval workflows, and moves data between the apps that profile is signed in to. Today Manifold announces coverage for what happens after the door. One extension in managed Chromium browsers, pushed through MDM. It knows which tab is talking to which AI provider and binds only to those sessions; traffic that isn't an AI session is never collected. For agents that drive the browser, it reconstructs every step into one auditable timeline: the prompt, each tool call, the approval decision, the result, and page-level evidence, correlated by tab and time. A step that breaches policy is flagged and recorded as it happens. All of it runs in the same Manifold policy engine and audit pipeline: - AI in tabs: ChatGPT, Claude, Gemini, Perplexity, Cursor and more - Agents that operate the browser: Claude in Chrome, ChatGPT and Gemini agents, more to follow - Autonomous development agents like Replit Read more here: https://lnkd.in/d3ScY8Qn

🔴 I'm showing you LIVE what third-party[.]com, the compromised placeholder domain cited across 1,700+ GitHub repos, several skills and MCP servers, is doing right now ‼️ If you're familiar with #ClickFix attacks, this will ring a bell. Full breakdown and IOCs on https://lnkd.in/eZBNXP2f Shout out to Swapnil P. for the finding, and props to Cody Nash Yurii S. for tracing the affected assets. cc Manifold Security Neal Swaelens Oleksandr Yaremchuk Bastien Eymery Zak Rautenbach Loretta Nguyen

When Claude in Chrome or GPT-6 Astra runs inside an enterprise, what is actually happening in the browser? We spent the last few months building the answer. Manifold's extension sits inside managed Chromium browsers, knows which tab is talking to which AI provider, and watches only those sessions. Traffic that is not an AI session is never collected. For agents that operate the browser, it records every tool call, the approval decision, the result, and page-level evidence of what each step left behind, correlated by tab and time. A step that breaches policy is flagged the moment it happens. That is what makes Manifold the first platform to package all of this together: the agentic tools employees run in tabs (ChatGPT, Claude, Gemini, Perplexity, Cursor, Replit, and more), the agent that drives the browser itself (Claude in Chrome, ChatGPT Browser use, with more to follow), and the agents on the endpoint, under one policy engine with one audit pipeline. One extension, pushed through MDM. You see what the agent actually did: the exact tool calls, the data movement, the step that breached policy. Full story: https://lnkd.in/dNVHUnMY

In July we showed that any browser extension could push Claude for Chrome into reading a victim's Gmail, Docs and Calendar. Your gateway would log authenticated HTTPS to claude[.]ai. Your EDR would log a signed extension behaving like one. But no alert, anywhere. ( That disclosure was just one extension from one vendor: https://lnkd.in/eK5hUm24 ) This month, GPT-6 Astra arrived with state-of-the-art browser use and enterprise rollout across ChatGPT. Browser agents are about to be standard issue: reading thousands of pages, signing in to SaaS with the employee's credentials, moving data across workflows. To the browser, the agent is the user. Same-origin policy and CORS were never designed to separate the two. The web fights back too. Anthropic's own published figures put prompt injection success at 3.8% per attempt before safeguards and 0.3% after. Multiply 0.3% by a workforce reading thousands of pages a day and you have a steady stream of hijacked sessions that no existing control even logs. Manifold Security now covers that layer. We monitor Claude in Chrome, ChatGPT browser use and the agent driving the browser itself, and govern them alongside the agentic tools in employees' tabs, with the same real-time enforcement and audit trail we run at the endpoint. Guidance for security teams: https://lnkd.in/es_GgUFe

𝗖𝗹𝗮𝘂𝗱𝗲 𝗖𝗼𝗱𝗲. 𝗖𝗼𝗱𝗲𝘅. 𝗖𝘂𝗿𝘀𝗼𝗿. 𝗚𝗼𝗼𝘀𝗲. 𝗤𝘄𝗲𝗻 𝗖𝗼𝗱𝗲. 𝗚𝗿𝗼𝗸 𝗕𝘂𝗶𝗹𝗱. 𝗛𝗲𝗿𝗺𝗲𝘀. 8 findings across 7 major AI coding agents, all the same class of flaw. It's called 𝗚𝗶𝘁 𝗦𝗽𝗮𝘄𝗻. The whole infosec sphere is talking about it. The researcher who found it is Francisco Rosales of Manifold Security, and I'm going to make him explain Git Spawn to us like I'm five. 👉 For those who prefer to read: https://mnfld.se/gith-r7k