Open a folder with Claude Code and it runs git status before you type anything. It runs before the workspace-trust prompt appears, and on some agents before you have authenticated. A folder that came from somewhere else decides what that command executes.
Manifold Security disclosed the flaw in early September as GitSpawn: eight findings across seven command-line AI coding agents.
Git does the work, not the model
Manifold's framing explains the case better than any summary: nothing here is new, and nothing here lives in the model. The bug sits in the subprocess an agent starts at session startup to work out where it is.
Agents need context constantly. Which branch is this? What changed? What is staged? Several products answer those questions by invoking Git in the background. Git reads repository-local configuration when it runs, and some settings, core.fsmonitor among them, name a command that Git executes.
A malicious .git/config needs one section:
source links: https://www.hamvero.space/blog/gitspawn-ai-agents-git-config-rce/
Top comments (0)