A Git Setting Let Attackers Run Code in 7 AI Coding Agents Before You Ever Hit Approve

A Git Setting Let Attackers Run Code in 7 AI Coding Agents Before You Ever Hit Approve

Security researchers at Manifold Security disclosed a vulnerability this month, nicknamed GitSpawn, that turns a routine git command into arbitrary code execution across seven different AI coding agents. The part that should worry you isn't the vulnerability itself so much as when it fires: before any trust prompt, before any sandbox check, the moment the agent runs `git status`.

How GitSpawn actually works

The exploit abuses a repository-level git configuration setting called `core.fsmonitor`. Normally this setting points to a file-monitoring helper that speeds up git operations on large repos. GitSpawn's trick is simple once you see it: a malicious repo can set `core.fsmonitor` to point at an arbitrary command instead of a real monitor binary. The next time anything, including an AI coding agent, runs a routine git operation like `git status` inside that repo, git executes whatever `core.fsmonitor` points to.

Because this fires during a plain git status check rather than during an explicit "run this code" action, it sidesteps the approval prompts and sandboxing that AI coding agents normally rely on to keep a human in the loop before anything executes. Manifold Security describes the result plainly: arbitrary code execution as the developer, outside the sandbox, with no approval prompt.

Which agents were affected

Seven agents were confirmed vulnerable at disclosure:

If you're running [Cursor](https://questloops.com/tools/cursor) or Claude Code and haven't checked your version number against this table, that's the first thing to go do, not the last. The partial patch status on Claude Code is worth sitting with for a second: even after the initial fix, the "ultrareview" path stayed exploitable through version 2.1.252, which means a version number alone doesn't guarantee you're covered depending on which review mode you use.

The blast radius is bigger than it sounds

Claude Code alone sees roughly 77 million npm downloads a month. That's not 77 million individual vulnerable installs, package managers count differently, but it gives you a sense of how many developer machines were touching a tool that had an unauthenticated, pre-approval code execution path for some window of time before the patch landed.

Why this is part of a bigger pattern

GitSpawn isn't an isolated disclosure. It landed in the same week as two other AI agent security launches that are worth knowing about if you're trying to actually reduce this kind of risk rather than just patch and move on:

• **Watcher Live**, built by Apollo Research, hooks into Claude Code and Codex and grades every tool call through a mix of regex rules, a triage model, and a full evaluator. Its published numbers claim 93% recall on high-severity cases with under 1% false positives and under 0.1% human escalation, at a 3 to 5% cost overhead and 6 to 8% added latency. It ships a free tier alongside enterprise options, with Copilot and Cursor support on its roadmap.
• **AIR Security** came out of stealth on September 1 with $50 million in funding, led by Sequoia and Greenoaks, and pitches itself as an inline firewall that discovers running agents, vets the skills and MCP servers they load, and blocks malicious instructions before they reach an agent's context. It's built for enterprise security teams rather than individual developers, and doesn't publish a self-serve free tier.

That two well-funded, credible attempts at agent runtime monitoring launched the same month as a disclosure like GitSpawn isn't a coincidence. It's a sign that the industry increasingly agrees the "approval prompt" model AI coding agents lean on has real gaps, and that catching bad tool calls after the fact is becoming as important as trying to prevent every exploit before it ships. Questloops covered this same shift toward [testing and grading AI agent output](https://questloops.com/blog/ai-agents-are-grading-their-own-code-a-new-wave-of-testing-tools-wants-to-stop-that) last month, and GitSpawn is a clear example of why that shift is happening.

What to actually do about it

1. Check your coding agent's version against the patched releases above, and if you're on Claude Code, confirm which review mode you're running given the "ultrareview" gap
2. Treat any repository you didn't create yourself as untrusted until your agent's version is confirmed patched, especially repos you clone just to poke around in
3. If you're on Hermes Agent, Qwen Code, or Grok Build, there was no patch at disclosure time. Check for an update before running any of them against a repo you don't fully trust
4. If tool-call monitoring matters to your workflow, Watcher Live's free tier is worth a look given it already supports Claude Code and Codex directly

The bottom line

A single git configuration setting, one most developers have never manually touched, was enough to get arbitrary code execution in seven different AI coding agents before any approval step ever fired. Four of the seven had real patches within weeks. Three didn't. If your workflow touches any of them, this is a five-minute version check that's worth doing today rather than after something goes wrong.