AI Coding Agents Can Execute Malicious .git Configs

The 'GitSpawn' vulnerability is a real risk that lets a malicious repository execute arbitrary code on your machine through your AI coding agent. It’s not theoretical; researchers at Manifold Security demonstrated it against agents from Anthropic, OpenAI, and xAI. The flaw is simple and effective, bypassing the agent's sandboxing entirely.

What is the 'GitSpawn' attack?

The vulnerability, discovered by Manifold Security, exploits the trust AI coding agents place in the `git` command-line interface. A malicious actor can craft a repository with a booby-trapped `.git/config` file. When an AI agent is instructed to perform a git operation in that repository—like fetching changes or checking status—it can inadvertently trigger a command defined by the attacker, executing it with the user's permissions.

How does the exploit work?

Git's configuration allows for aliasing commands. An attacker can set up a malicious alias in the repo's local `.git/config` file. For example, they could define `fetch` to not only run the real `git fetch` but also execute a malicious script. When the agent runs `git fetch` as part of its workflow, it executes the attacker's payload. According to the security researchers' original disclosure, at least seven agents were confirmed vulnerable, including Claude Code and Cursor.

A concrete example is redefining a common Git hook. A config might contain: ``` [core] hooksPath = .githooks ``` An attacker simply places an executable script at `.githooks/post-checkout` in the repository. The next time the agent runs `git checkout` or a similar command, the script runs directly on the host machine.

Should you use these agents?

Verdict: No, not on untrusted repositories. This vulnerability is a symptom of a larger design failure. Giving an AI agent shell access and pointing it at arbitrary, untrusted code without robust, mandatory sandboxing is negligent. Convenience does not justify compromising the security of your development environment.

While vendors for tools like Claude Code and Cursor have issued patches, the fundamental risk model for many of these agents is broken. Until agents operate in properly isolated environments by default, I would not let one touch a repository I didn't personally create or vet extensively. The risk of code execution is too high.

FAQ

Which AI coding agents are affected? The initial disclosure confirmed vulnerabilities in agents built with models from Anthropic (e.g., Claude Code), OpenAI, and xAI (Grok), as well as dedicated tools like Cursor. You must check with your specific tool's vendor for its patch status.

Is this a flaw in Git itself? No. This is an intended Git feature being used in a malicious context. The actual flaw lies with the AI agents, which execute `git` commands inside untrusted repositories without sufficient sanitization or isolation from the host system.

How can I protect myself from GitSpawn? Update your AI coding tools and assistants immediately. The most important step is to avoid pointing AI agents at unknown or untrusted Git repositories. If you must work with one, do it in a containerized or virtualized environment to limit potential damage.