New research has found a significant flaw linked to AI coding agents that could grant an attacker the ability to run arbitrary code as if it was coming directly from you, with all the privileges and access that you would normally enjoy. And according to the report, this vulnerability isn’t just found in one AI bot – many different automated coding tools can be exploited in this way, including some of the biggest names in the industry.
The attack – dubbed GitSpawn by Manifold Security – is centered on the process that gets underway when you first launch a command line interface (CLI) AI agent. The researchers found that, in most cases, agents will run certain git commands in order to gather context, such as which project they are running and which files have been modified since the bot was last used.
The problem is that these processes are run before the user types anything and often before they have authenticated themselves. It therefore gives a savvy attacker an opportunity to run arbitrary code without the usual security checks that might stymy their efforts. And because these checks run in the background, you might not even be aware of what is happening.
If you’re working on a large repository, Git is able to speed up the process by calling on a helper program. Each repo will name that program within its configuration file, and your AI agent of choice will run whatever app is named in that file.
According to Manifold Security, one way an attacker could exploit this situation is by getting an AI agent to start work on a compromised code repository. If a hacker names a malicious program instead of the helper inside the repository, the AI agent will run it, all before any authentication or safety checks come into play. And that is where the flawed system can quickly escalate into a security incident.
Some agents remain unpatched
The report found that many different AI coding agents were affected. Goose, Claude Code and Cursor were vulnerable but had released patches by the time Manifold Security published its findings. Exploits were still possible in OpenAI Codex, Hermes Agent, Qwen Code and Grok Build, while a second attack method could be executed in Claude Code, even after the primary flaw had been patched.
Importantly, Manifold Security found that this attack can’t be executed through a simple git clone procedure – “Cloning a hostile URL does nothing, and neither does fetch or pull,” the researchers noted.
Instead, a threat actor would have to spread their tainted repo in another way. “The repository has to arrive as files with its .git directory already inside,” Manifold Security explained, “so the vector is anything that moves a directory instead of cloning it: a shared .zip, a shared drive, a sync folder, a USB stick.”
As the researchers pointed out, this is a common way for colleagues to share files or for consultants to pass data to clients. What might seem like an innocuous action could thus lead to a security incident if you’re not careful.
To protect your organization, Manifold Security recommended that if you receive a repository as files, you should inspect .git/config before running an AI agent. Any setting that names a program can run it. If you ship an AI agent, sanitize the git config on all context-gathering calls it makes in the background, for example git -c core.fsmonitor=false status.
AI coding agents aren’t going anywhere, so this kind of behavior needs to be better understood before it goes on to cause real problems. If you rely on this type of software to get coding work done at your business, it’s important to ensure it’s not doing anything it shouldn’t before it leads to trouble.
