Entity · DiggingBeagle record
Mistral Vibe
Coding agent whose Git-based project introspection produced three distinct pre-trust execution paths.
Record description
Mistral Vibe is a developer coding assistant that reads repository metadata during session initialization. Three separate November 2026 advisories concern the gap between opening a project and actually approving it as trusted: Windows Git executable resolution, Git filter helper execution and Git signature verifier execution. All three involve host process behavior before the model has any need to interpret a malicious instruction. They have separate fixes and different configuration prerequisites.
The three affected pretrust operations and repair thresholds differ. On Windows, project-local executable lookup was fixed in 2.25.5; a pretrust git status path could invoke configured filter drivers until 2.25.7; and git log with enabled signature display could invoke a configured signature verifier until 3.0.3. The latter two require attacker-effective Git configuration, which a normal clone does not automatically install. All are host subprocess execution paths, not demonstrated prompt-following failures.