GitSpawn Vulnerabilities Allow Malicious Commands to Run Through AI Coding Agents
Manifold Security researchers revealed a group of security vulnerabilities in September 2026 known as GitSpawn, affecting seven AI-powered coding tools, including Claude Code, OpenAI Codex, Cursor, Goose, Qwen Code, Grok Build, and Hermes Agent. Researchers documented eight vulnerabilities linked to this class of attacks.
The issue involves Git configuration files within a project, particularly the core.fsmonitor setting, which is normally designed to improve Git performance. An attacker can, however, place a malicious command within a repository’s Git configuration. When an AI coding agent examines the project and runs Git commands such as git status or git diff, the malicious command can potentially be executed automatically. The security risk is significant because the command may execute outside the AI agent’s normal command-approval mechanism. In some of the scenarios tested by researchers, execution could occur before the user was presented with a project trust prompt or even before authentication. If successfully exploited, the attack can execute commands with the same permissions as the affected user. Depending on the environment, this could potentially expose files, SSH keys, cloud credentials, access tokens, or other resources available to the user’s account. The attack requires the project’s .git directory to reach the user’s machine. This makes repositories distributed through archives, shared folders, or external storage particularly important to inspect. A standard git clone operation does not transfer the remote repository’s .git/config file in the same way Following the disclosure, updates were released to address several of the affected cases, while other issues remained under investigation or remediation in some tools. Developers are advised to keep AI coding tools updated, avoid opening untrusted repositories directly in AI agents, inspect Git configuration before working with unfamiliar projects, and pay particular attention to settings such as core.fsmonitor and core.hooksPath. The GitSpawn incident highlights a broader security challenge surrounding AI-powered development tools: the risks are not limited to the instructions given to an AI model. Malicious files, configurations, and development tools within a project can also become potential attack vectors when AI agents interact with them automatically.