GitSpawn: The Malicious Git Repository That Hijacks AI Coding Agents

On September 1, 2026, Manifold Security published research on GitSpawn, an attack pattern affecting several AI coding agents. The technique abuses automatic Git operations performed by some agents when opening a project, allowing a malicious repository to execute code with the developer’s privileges.

Manifold reported eight execution paths across seven agents, including Claude Code, OpenAI Codex, Cursor, Grok Build, Goose, Hermes Agent, and Qwen Code. Patch status varies by product and version.

How the Attack Works

Step 1: A malicious project is delivered with its .git folder intact and a crafted .git/config using Git’s core.fsmonitor setting.

Step 2: The AI coding agent automatically runs Git commands, such as git status, to gather project context.

Step 3: Git processes the malicious configuration and executes the attacker-controlled command with the developer’s privileges.

Step 4: This specific vector is not delivered through a normal git clone, fetch, or pull. The malicious .git/config must already exist in the project, such as in a ZIP file, shared folder, synced directory, or USB transfer.

Best Practices

1. Disable the primary vector: Run git config –global core.fsmonitor false on any developer workstation where git and an AI coding agent run.

2. Update AI coding agents: Apply available security updates and check current vendor advisories for affected products.

3. Treat file-transferred repositories as untrusted: Inspect .git/config before opening them in an AI coding agent, or remove the .git directory before analysis.

4. Use trusted Git workflows: A normal git clone does not carry the repository’s original .git/config through this specific attack path.

5. Monitor endpoint activity: Look for unexpected processes launched by Git or AI coding agents, particularly during project startup.