GitSpawn: A Malicious Repository Can Make Your AI Coding Agent Run Attacker Code

• The Mess: Researchers found that AI coding agents can automatically execute Git commands while inspecting a repository, allowing a malicious .git/config to trigger attacker-controlled code before the developer has actually started working on the project.
• The Damage: Simply opening or analyzing a hostile repository can turn a coding assistant into an execution path for supply-chain attacks, exposing developer machines, credentials, source code and cloud access.
• The Fix: Update affected AI coding agents, disable unnecessary automatic Git operations, treat untrusted repositories as hostile input and inspect repository configuration before allowing an agent to work inside it.

AI coding agents are supposed to save developers time.

GitSpawn shows how that automation can also save attackers time.

Researchers at Manifold Security described a new class of attacks targeting AI coding agents that automatically interact with Git repositories. The problem is not a vulnerable application hidden somewhere inside the project.

The repository itself can be the trap.

A malicious Git configuration can abuse automatic Git operations performed by an AI agent and trigger attacker-controlled code on the developer’s machine.

The developer may not even need to run the project’s code.

Opening the repository can be enough.

Git Commands Are Not Always Harmless

Most developers think of Git as infrastructure.

Clone.

Status.

Diff.

Log.

Fetch.

Boring commands that move code around.

But Git is more programmable than it looks.

Repository configuration can define hooks, aliases and external helpers. Git can also interact with remote helpers and credential mechanisms.

That flexibility becomes dangerous when another application automatically executes Git commands inside an untrusted repository.

The AI agent is effectively making security decisions on behalf of the developer.

It enters the workspace.

It inspects files.

It checks repository state.

It reads history.

It may contact remotes.

It performs commands automatically because the entire point of an agent is to avoid asking the human to do every boring step manually.

GitSpawn turns that convenience into an attack surface.

The Agent Pulls the Trigger

The important detail is automation.

A traditional developer workflow usually includes friction.

The human chooses to run a command.

The human sees what is happening.

The human may notice something strange.

An AI coding agent removes part of that friction.

It may execute Git operations immediately after being pointed at a repository.

Researchers found that malicious repository configuration could abuse those operations and cause the agent to execute attacker-controlled code.

The victim does not need to:

• compile the project
• run a binary
• start a server
• execute a build script
• manually approve a shell command

The repository can weaponize the environment around it.

That is a nasty change in the supply-chain threat model.

Seven AI Coding Agents Were Tested

Manifold Security tested seven popular AI coding agents:

• Claude Code
• Codex
• Cursor
• Grok Build
• Goose
• Qwen Code
• Hermes Agent

According to the research, multiple products were affected by Git-related attack paths.

The exact impact depends on how each agent interacts with repositories and whether fixes or mitigations have already been released.

But the larger problem goes beyond one vendor.

The attack class exists because autonomous coding agents increasingly perform privileged actions inside development environments.

They have access to repositories.

They may access terminals.

They may read configuration files.

They can search source code.

They can use stored credentials.

Some can interact with cloud services or developer tools.

Giving an agent more autonomy makes it more useful.

It also gives malicious input more opportunities to influence what the agent does.

The Repository Is Now Part of the Attack

Software developers have spent years learning to distrust dependencies.

A package can be malicious.

A library can be compromised.

An update server can be hijacked.

GitSpawn adds another uncomfortable layer.

The repository itself can attack the tooling used to inspect it.

That means “I didn’t run the code” is no longer a useful security argument.

If your AI agent automatically touches Git before you run anything, the code execution path may happen before the traditional review process even begins.

The attack surface moves earlier.

Much earlier.

AI Agents Change the Meaning of Opening a Project

Opening an untrusted repository used to be relatively simple.

You inspect it.

You read the README.

You look at the source.

You decide whether to run anything.

AI coding agents are changing that workflow.

The moment an agent enters the project, it can begin acting.

It may create an inventory.

Check Git status.

Read configuration.

Inspect commits.

Fetch context.

Run tools.

The human sees a chat window.

Behind it, automation is touching the local development environment.

That creates a security boundary developers are not used to thinking about.

The AI agent is not simply reading the repository.

It is operating inside it.

Supply-Chain Attacks Love Trusted Automation

This is why GitSpawn matters.

Supply-chain attacks often work by abusing trust.

A developer trusts a package.

A build server trusts a dependency.

A user trusts an update.

An AI agent trusts its own workflow.

Attackers look for places where automated systems assume input is safe.

The more automated the workflow, the fewer chances a human has to notice something unusual.

That does not mean AI coding agents are inherently unsafe.

It means their security model cannot be the same as a text editor.

A text editor opens files.

An autonomous agent can interpret those files and take actions.

That difference is everything.

Credentials Make the Blast Radius Worse

A developer workstation is rarely an isolated machine.

It can contain:

• SSH keys
• GitHub tokens
• cloud credentials
• API keys
• package publishing credentials
• Kubernetes configuration
• CI/CD secrets
• VPN access

An attacker who achieves code execution through a malicious repository may not care about the repository at all.

The repository is simply the delivery mechanism.

The real target can be everything the developer’s environment already trusts.

That makes coding-agent security a supply-chain problem.

The Fix Is Bigger Than One Patch

Updating affected tools is important.

But GitSpawn exposes a broader design problem.

AI agents should treat untrusted repositories as hostile input.

That means:

• isolate agent execution where possible
• avoid automatic Git operations in untrusted workspaces
• restrict shell and tool permissions
• separate credentials from disposable analysis environments
• review repository configuration
• avoid giving agents unnecessary access to cloud and CI/CD systems

Developers should also think carefully before connecting an autonomous agent to a repository downloaded from an unknown source.

If you would not execute a random shell script from that repository, you should not assume an AI agent can safely inspect it without controls.

The New Security Question

For years, developers asked:

Can I trust this code?

AI coding agents introduce another question:

Can I trust the environment my agent creates while inspecting this code?

Those are not the same thing.

And GitSpawn exists in the gap between them.

Bugstoday Opinion

AI coding agents are becoming part of the development toolchain faster than their security boundaries are becoming obvious.

The danger is not that the agent becomes malicious.

The danger is that it is obedient.

Give it a repository.

Tell it to investigate.

It starts doing exactly what it was designed to do.

Run commands.

Inspect Git.

Explore the environment.

And if the repository can influence those actions, the agent becomes the attacker’s hands on the developer’s machine.

Bugstoday verdict: The moment an AI coding agent starts acting instead of merely reading, every repository it touches becomes part of your attack surface.

Today’s Bugs. Tomorrow’s Breaches.

Sources

• Manifold Security — GitSpawn Research
• Git Documentation — Configuration and Remote Helpers
• OWASP — Software Supply Chain Security
• AI Coding Agent Vendor Security Advisories