GitSpawn: untrusted repos can hijack your AI coding agent
Security researchers at Manifold found a code execution path hiding inside a routine git operation. They named it GitSpawn, and it affects every CLI AI coding agent they tested: Claude Code, Goose, Grok Build, Hermes, and Qwen Code. They note the same pattern appeared in additional agents they chose not to name.
How It Works
When a CLI agent opens a project, it gathers context. Branch name, modified files, tracked paths. To do that, it runs standard git commands like git status --porcelain=2 --branch and git diff --name-only HEAD. Nothing unusual there.
The problem is that most of these commands trigger a git index refresh. And core.fsmonitor, a documented git performance setting, lets any repository specify a helper program that runs during that refresh. Git reads the setting from the repository’s own .git/config file. So a repository can ship this:
[core]
fsmonitor = <command>When the agent calls git, git calls the command. On your machine. With your privileges. Before any approval prompt appears. The researchers also note that core.fsmonitor is not the only setting that behaves this way.
The Permission Model Never Sees It
This is what makes GitSpawn different from a typical prompt injection. The agent’s own code spawns the subprocess to use git, so the execution happens outside the agent’s sandbox entirely. The approval flow that most coding agents use for file writes and shell commands does not apply here.
Cloning a repository does not trigger this. Git strips the .git/config settings during clone. The attack requires the repository to arrive as files with its .git directory already present. A .zip archive is the cleanest delivery mechanism. The researchers used a .zip for every proof of concept they built. Shared drives, sync folders, and USB transfers work the same way, all common in client and contractor workflows.
What to Do Now
If you use any CLI coding agent and you regularly open project folders sent by colleagues, clients, or contractors as zip files, treat those archives with the same caution you would give an executable. The researchers published their findings at manifold.security. No patch or workaround is mentioned in the source at time of writing.
I’m founder of BizStack at Cagri Sarigoz LLC and a passionate advocate for entrepreneurs.
With over 14 years in tech, marketing, and AI, including my role as Head of SEO at CitizenShipper and co-founder of TaleBot at Intale AI, I’m dedicated to sharing genuine, useful product insights and tips.
At BizStack, I aim to cut through the digital noise to provide clear, actionable advice.
And more than all else, I’m a father to a (always) little girl and a husband.
Contact me at [email protected] for assistance.
