GitSpawn: Unsanitized Git Context Lets Attackers Hijack Claude Code, Cursor, Codex and Other AI Coding Agents
Manifold Security's GitSpawn disclosure shows that AI coding agents including Claude Code, Codex, Cursor, Grok Build, Hermes, Goose and Qwen Code run git commands on untrusted folders before trust prompts — letting a poisoned .git/config achieve arbitrary code execution.
Executive Takeaway — TL;DR
- Category:
- Zero-Day Exploits
- Severity:
- High
- Actor Type:
- Unknown
- Geography:
- Global
- Confidence:
- High Confidence
- MITRE ID:
- T1195.002, T1059
- Source:
- Manifold Security
- Read Time:
- 5 min
A Repository That Attacks the Agent That Opens It
Manifold Security disclosed GitSpawn on 1 September 2026, a class of vulnerability affecting a broad set of AI coding agents. The core problem is simple: to build workspace context, agents such as Claude Code, Codex, Cursor, Grok Build, Hermes, Goose and Qwen Code run git commands almost immediately after opening a folder. When that folder is untrusted — a cloned repository, a downloaded archive, a shared project — content in files like .git/config is consumed without proper sanitization.
The result is arbitrary code execution, in several implementations occurring before the workspace-trust prompt or even authentication has been completed.
Why This Is a Supply-Chain Problem
Developers clone repositories dozens of times per week. A malicious or compromised repo no longer needs the developer to run anything — simply opening it in an AI-enabled editor is sufficient. This turns the coding agent itself into the initial-access vector, inheriting the developer's cloud tokens, SSH keys and internal network position.
Disclosure Status
Manifold coordinated disclosure with affected vendors. At publication, Codex and Cursor were reported patched; status for the remaining agents was mixed. No confirmed production victim or in-the-wild exploitation has been reported in the current window, so Encrygma classifies this as a LAB-TEST finding with high latent impact.
Defensive Implications
- Update every AI coding agent in your fleet immediately and verify vendor patch notes for GitSpawn.
- Do not open untrusted repositories in agent-enabled editors until patched; use a disposable container for triage.
- Strip standing credentials from developer machines where agents run; rotate any tokens exposed to agent contexts.
- Add
.git/configand hook content inspection to repo-ingestion pipelines.
Sources
Manifold Security, "AI coding agents git hijack" (1 Sep 2026).
Sources
- 1.Manifold Security — GitSpawn: AI coding agents git hijackPrimary coordinated disclosure
Need Zero Click Spyware for Android and iOS?
Encrygma delivers serverless, offline, quantum-safe encrypted communications built for executives, agencies, and operators facing zero-click spyware and advanced mobile surveillance threats.