Vulnerability class named by Manifold Security: a repo's Git config, such as core.fsmonitor, makes AI coding agents run attacker code via routine git calls.
Manifold Security's GitSpawn lets a repo's .git/config run any command through a coding agent's background git calls, with no approval prompt. It needs the repo to arrive as files, since git clone never carries that config; a client's zip will do.
Reality
Manifold Security reported eight instances across seven command-line agents. The command runs as the user, outside the sandbox, with no approval prompt, and four were still firing when the researchers retested on September 1.
Reality
GitSpawn, as summarised in a dev.to write-up of Cloud Security Alliance findings, uses a Git performance setting to run attacker code when a coding agent inspects a project it just opened. Seven agents are named.
Reality
Manifold Security's GitSpawn findings cover eight issues across seven coding agents. The path runs through core.fsmonitor, where a background git status starts a helper the repository chose, outside the agent's sandbox and with no prompt.
Reality
The wiki's old software took a plain GET as an edit, so a harness that policed request types could not stop the writes. GitSpawn puts the same gap in the startup git calls of seven coding agents.
Reality