GitSpawn: malicious .git/config files hijack AI coding agents
If your team clones untrusted repos and runs them through an AI coding agent, a class of vulnerabilities called GitSpawn is worth understanding right now.
What the Attack Does
Researchers at Manifold Security found that a malicious .git/config file can force AI coding agents, including Claude Code, Cursor, Codex, and Goose, to execute attacker-controlled commands on the developer’s machine. The key abuse is a legitimate git feature: core.fsmonitor. When git runs an index refresh during a normal diff operation, it executes whatever command is set in that field.
The commands run before any trust prompt, sandbox, or tool-permission model engages. The developer sees nothing unusual. The agent never contacts a model before the payload fires.
Why This Is Different From Prompt Injection
Most AI agent security discussions focus on prompt injection, where crafted text in a file or web page manipulates the model’s output. GitSpawn bypasses that entirely. There is no prompt involved. The attack abuses git itself, which the agent calls as a subprocess to gather context, and that subprocess is not sandboxed.
For Goose specifically, the CVE (CVE-2026-72718, CVSS 7.0 HIGH) describes the vulnerable path clearly: the goose review command calls git diff HEAD without stripping attacker-controlled git configuration. Arbitrary commands run with the full privileges of the user running the agent, including access to environment secrets and provider API keys.
Scale of Exposure
Claude Code alone exceeds 77 million monthly npm downloads, according to the source. That is the surface area vendors are now racing to harden.
Where Things Stand
Vendors issued patches following Manifold’s disclosure. However, the researchers noted that several attack paths remained open at the time of disclosure. Organizations running AI-assisted development pipelines should treat untrusted repository handling as a first-class security concern, not an edge case.
The practical step today: audit how your AI coding tools invoke git, and avoid running agents against repos you do not control until you have confirmed you are on a patched version.
I’m founder of BizStack at Cagri Sarigoz LLC and a passionate advocate for entrepreneurs.
With over 14 years in tech, marketing, and AI, including my role as Head of SEO at CitizenShipper and co-founder of TaleBot at Intale AI, I’m dedicated to sharing genuine, useful product insights and tips.
At BizStack, I aim to cut through the digital noise to provide clear, actionable advice.
And more than all else, I’m a father to a (always) little girl and a husband.
Contact me at [email protected] for assistance.
