A new security flaw, GitSpawn, allows downloaded code repositories to execute hidden commands on your PC through AI coding agents, even before you give approval. This vulnerability bypasses agent sandboxes and traditional security prompts.
Big news for anyone using AI coding agents: a sneaky vulnerability called GitSpawn could be putting your machine at risk. It turns out that those seemingly innocent `git status` or `git diff` commands your coding agent runs automatically in the background could be triggering malicious code hidden within downloaded repositories.
Here's the rundown: When you download a code project and point an AI agent at it, the agent usually runs basic Git commands to understand the repository. The trick is, these commands don't just gather info; they can unknowingly execute other programs. Malicious commands can be embedded in the repository's own `.git/config` file, using legitimate Git performance settings like `core.fsmonitor`. This setting tells Git which files changed, but its value can be a command that Git then runs.
Manifold Security discovered this pattern, named GitSpawn, in September 2026. The danger is real: the embedded command runs as your user, on your machine, completely outside the agent's security sandbox, and without any approval prompts. Shockingly, some agents like Claude Code and Hermes Agent fire these hidden commands even before you accept a workspace-trust prompt. Qwen Code triggers it before authentication, and Grok Build on your very first keystroke! This isn't about AI models being tricked; it's about Git's own internal workings being exploited.
So, what should you do? Before letting an AI coding agent loose on any downloaded repository, run this crucial command in your terminal for that repository: `git -C /path/to/repo config --local --list --show-origin`. If the output includes `core.fsmonitor`, `core.hooksPath`, `attr.tree`, or anything under `filter.` or `diff.` that names a command, stop! That's your red flag.
The good news is that some agents, like Goose (fixed in 1.44.0) and OpenAI Codex CLI, have already addressed this flaw. But staying vigilant is key. Always be cautious with code from unknown sources, especially when using automated tools. Your security starts with awareness.
Here's the rundown: When you download a code project and point an AI agent at it, the agent usually runs basic Git commands to understand the repository. The trick is, these commands don't just gather info; they can unknowingly execute other programs. Malicious commands can be embedded in the repository's own `.git/config` file, using legitimate Git performance settings like `core.fsmonitor`. This setting tells Git which files changed, but its value can be a command that Git then runs.
Manifold Security discovered this pattern, named GitSpawn, in September 2026. The danger is real: the embedded command runs as your user, on your machine, completely outside the agent's security sandbox, and without any approval prompts. Shockingly, some agents like Claude Code and Hermes Agent fire these hidden commands even before you accept a workspace-trust prompt. Qwen Code triggers it before authentication, and Grok Build on your very first keystroke! This isn't about AI models being tricked; it's about Git's own internal workings being exploited.
So, what should you do? Before letting an AI coding agent loose on any downloaded repository, run this crucial command in your terminal for that repository: `git -C /path/to/repo config --local --list --show-origin`. If the output includes `core.fsmonitor`, `core.hooksPath`, `attr.tree`, or anything under `filter.` or `diff.` that names a command, stop! That's your red flag.
The good news is that some agents, like Goose (fixed in 1.44.0) and OpenAI Codex CLI, have already addressed this flaw. But staying vigilant is key. Always be cautious with code from unknown sources, especially when using automated tools. Your security starts with awareness.
