GitSpawn Vulnerability Enables Remote Code Execution in AI Coding Agents

Security researchers at Manifold Security have disclosed "GitSpawn," a class of vulnerabilities affecting several command-line AI coding agents. The flaw allows attackers to execute arbitrary code on a developer's machine by embedding malicious commands within a repository's configuration files.

The vulnerability leverages `core.fsmonitor`, a Git performance setting designed to execute a specified command to identify changed files during routine operations such as `git status` or `git diff`. When an affected AI agent initializes a session, it spawns subprocesses to determine the repository's state, triggering the malicious command. According to Manifold Security, the issue resides not in the AI models themselves, but in the "ordinary plumbing underneath"—the subprocesses the agent uses to orient itself at startup.

The Attack Vector

Exploitation of GitSpawn requires the target repository to be delivered with the `.git` directory intact. This typically occurs via shared ZIP archives, USB sticks, or synchronized folders, as the `.git/config` file is not transferred during a standard `git clone` operation. Once the agent accesses the folder, the malicious code executes with the full privileges of the user running the agent.

Crucially, this execution happens outside the agent's command sandbox and often occurs before any workspace-trust prompts or authentication checks are triggered. Because the helper runs without a user-approval prompt, attacker-controlled code can run with the user's privileges.

Industry Context

This vulnerability highlights a recurring problem with "pre-trust" execution in developer tools. Similar flaws have historically plagued established environments, including VS Code (CVE-2021-43891) and JetBrains IDEs (CVE-2022-24346). In these cases, the simple act of opening a project folder can trigger a remote code execution (RCE) event before the user has explicitly trusted the workspace.

Why It Matters

Because AI coding agents are often granted high privileges to edit source code and manage local files, the impact of GitSpawn is severe. An attacker can gain full access to a developer's system without the user ever interacting with the AI or approving a specific tool call. This transforms a routine task—opening a project folder—into a critical security breach, potentially exposing sensitive credentials, API keys, and proprietary source code.

Current Status and Fixes

Several agents have been identified as affected, including Claude Code, Goose, Hermes Agent, Qwen Code, and Grok Build. Patches have already been released for some of the impacted tools; Goose has issued a fix in version 1.44.0+, and Claude Code has patched the `core.fsmonitor` path in version 2.1.196+.

Developers are encouraged to update their agents immediately and remain cautious when opening repositories delivered via non-standard methods. Security teams continue to monitor for remaining unpatched paths in the affected agent ecosystem.