Critical GitSpawn Flaws Let Malicious Repositories Execute Code in AI Coding Tools

Key Takeaways

• A new class of vulnerabilities, named GitSpawn, enables malicious code execution via booby-trapped Git repositories.
• AI coding agents can trigger these flaws by automatically running Git commands, leading to silent code execution before user authentication or interaction.
• The attack leverages Git’s core.fsmonitor setting, which allows arbitrary commands embedded in a repository’s .git/config file to execute.
• Several popular AI coding tools, including Claude Code, Goose, Hermes Agent, Qwen Code, and Grok Build, were confirmed vulnerable, with some still unpatched.
• Developers should exercise caution when opening repositories received as raw files, and vendors must implement sanitization for Git configurations.

Critical GitSpawn Flaws Expose AI Coding Tools to Silent Code Execution

A recently discovered category of security vulnerabilities, collectively termed GitSpawn, allows specially crafted Git repositories to execute arbitrary code on a developer’s machine without any explicit user action. This silent compromise occurs the moment an AI coding agent accesses the repository, often before the user has even authenticated or typed a single command.

The Mechanics of the Attack

Security researchers at Manifold Security uncovered these critical flaws during an investigation into the startup behavior of various command-line interface (CLI) based coding agents. Their findings, detailed in a comprehensive Manifold Security report, reveal that most agents routinely execute Git commands like git status or git diff in the background to gather project context. While seemingly innocuous, these commands trigger Git to refresh its internal index, a process where the vulnerability lies.

Git includes a performance feature, core.fsmonitor, designed to specify a helper program that Git automatically runs whenever the index is refreshed. Crucially, this setting is read directly from the repository’s own .git/config file. A malicious repository can embed an arbitrary command within this configuration. Consequently, when an AI agent performs a routine Git command for context gathering, this embedded command executes with the full privileges of the logged-in user, entirely outside any sandboxing or permission systems, and completely invisibly.

It’s important to note that this attack vector cannot be exploited through standard Git operations such as git clone, fetch, or pull, as these actions do not transmit a hostile .git/config file. Instead, the compromised repository must be delivered as raw files with its .git directory intact. Common methods for such delivery include zipped folders, shared network drives, synced directories, or USB sticks – typical means by which developers exchange projects with colleagues and consultants.

Affected AI Coding Tools and Remediation Status

The research team successfully verified the GitSpawn vulnerability across several prominent AI coding platforms, including Claude Code, Goose, Hermes Agent, Qwen Code, and Grok Build. These tools collectively account for nearly half a million GitHub stars, with Claude Code alone boasting over 77 million monthly npm downloads. OpenAI’s Codex and Cursor were also found susceptible to variants of these flaws; both vendors issued patches following independent reports from other researchers.

Out of eight identified issues, four remain unpatched at the time of publication. This includes a distinct flaw in Claude Code’s ultrareview command, which exploits a different Git configuration key than core.fsmonitor. The specifics of this key were intentionally withheld by researchers to prevent providing attackers with a readily usable exploit template.

Goose has already addressed its vulnerability and has been assigned CVE-2026-72718. Hermes Agent, however, remains unpatched, with its vulnerability independently assigned CVE-2026-71963 after the vendor failed to respond to six contact attempts from the researchers.

What You Should Do

• Inspect Repositories: Developers who receive Git repositories as raw files (e.g., in a ZIP archive or via a USB drive) rather than through a git clone operation should meticulously inspect the .git/config file for any suspicious entries before opening it with an AI coding agent.
• Vendor Action: Vendors of AI coding agents are strongly urged to implement robust sanitization of Git configurations during background context-gathering calls. Specifically, explicitly disabling or neutralizing the core.fsmonitor setting for untrusted repositories can effectively mitigate this entire class of silent, pre-authentication code execution vulnerabilities.
• Stay Updated: Ensure all AI coding tools and Git clients are updated to their latest versions to benefit from any available patches.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.