When Opening a Repo Is the Attack: What GitSpawn Means for Every Team Using AI Coding Agents
GitSpawn proves that AI coding agents can be compromised simply by opening an untrusted folder. Here is why the finding matters, who is affected, and the practical controls engineering leaders should put in place this week.
The Threat Model Just Shifted
For two decades, the developer security mantra was "don't run untrusted code." GitSpawn, disclosed by Manifold Security on 1 September 2026, breaks that assumption. AI coding agents — Claude Code, Codex, Cursor, Grok Build, Hermes, Goose, Qwen Code and others — execute git commands the moment they open a workspace. Poison the repository's .git/config, and the agent executes attacker-controlled code before you are asked whether you trust the folder.
Nobody ran anything. They just opened it.
Why AI Agents Are Uniquely Exposed
Traditional editors read files. Agents act: they gather context, shell out to tools, and hold credentials so they can commit, deploy and query internal systems on your behalf. That combination — automatic execution plus privileged access — is exactly what makes GitSpawn dangerous. The attacker does not need to escalate; the agent already runs with everything the developer has.
Who Is Affected
Manifold's coordinated disclosure names a wide set of agents. Codex and Cursor were reported patched at publication; others were in mixed states. If your organization has not confirmed patch status for every agent in use, assume exposure.
The Realistic Attack Path
- Attacker publishes or compromises a repository — an open-source dependency fork, a coding-challenge repo, a "sample project" shared in a hiring process.
- Developer clones it and opens it in an agent-enabled editor.
- Git context gathering executes the payload.
- Payload harvests cloud tokens, SSH keys and session cookies, then pivots into CI/CD and internal services.
This is a supply-chain attack that needs no malicious package to be installed — only opened.
What Engineering Leaders Should Do Now
- Patch and verify. Inventory every AI coding agent across the fleet; confirm GitSpawn fixes with each vendor.
- Quarantine untrusted repos. Triage unfamiliar code in disposable containers or VMs without agent extensions.
- Strip standing credentials. Short-lived tokens, scoped permissions, no long-lived cloud keys on developer laptops.
- Inspect at ingestion. Scan
.git/config, hooks and submodule definitions in repo-intake pipelines. - Rehearse the response. Assume one developer opened a poisoned repo yesterday — can you find and contain it?
The Bigger Picture
GitSpawn is the first widely reported vulnerability class where the AI agent is the initial-access vector rather than a tool used by the attacker afterward. It will not be the last. Organizations adopting agentic development need to treat agents as privileged automation, with the same governance applied to CI runners and service accounts.
Source: Manifold Security, https://www.manifold.security/blog/ai-coding-agents-git-hijack
