GitSpawn Flaw Lets Malicious Repos Hijack AI Coding Tools

Open the wrong folder in Claude Code or Cursor and your SSH keys, cloud tokens and shell history could be gone before you've typed a single prompt. No pop-up asks for permission. No file gets double-clicked. You just open the project.

Security researchers at Manifold Security have disclosed a class of flaws they're calling GitSpawn, and it hits almost every popular AI coding assistant at once: Claude Code, OpenAI's Codex, Cursor, xAI's Grok Build, and several smaller agents including Goose, Hermes Agent and Qwen Code. The bug isn't in the AI models themselves — it's in a Git habit every one of these tools shares.

How a folder becomes a trap

Nearly every AI coding agent quietly runs background git status and git diff commands the moment you open a project, so it can understand what you're working on before you ask anything. That's normal and harmless — usually.

Git has a lesser-known performance setting called core.fsmonitor, which lets a repository specify a helper program that Git should run automatically whenever its file index refreshes. That setting lives inside a repo's own .git/config file. If an attacker plants a malicious command there instead of a real helper, then the instant an AI agent runs one of those routine background Git commands, it executes the attacker's code — silently, in the background, sometimes before you've even signed into the tool. In security terms, this is a zero-click remote code execution (RCE) bug: "remote" because the attacker who wrote the trap never has to touch your machine directly, and "zero-click" because you don't have to approve, open, or run anything for it to fire.

Why cloning from GitHub usually keeps you safe

Here's the twist: a normal git clone, git fetch, or git pull won't trigger GitSpawn, because those operations don't copy another repository's local .git/config onto your machine. The danger shows up when a project is handed to you as raw files with its hidden .git folder intact — a ZIP download, a shared drive, a synced cloud folder, a USB stick, or a project a client or "recruiter" emails you directly.

• A take-home coding assignment sent as a zipped repo
• A client codebase shared via Google Drive or a shared network folder
• An open-source contribution downloaded rather than cloned from a fork
• A pen drive handed over at a hackathon or a walk-in interview

Once opened in a vulnerable agent, the attacker can potentially reach SSH keys, cloud provider credentials, API tokens, shell configuration files, source code, and any other repository connected to that developer's account. Manifold's researchers say they reported the Claude Code version of this flaw on June 26, and it was patched in version 2.1.196 just three days later — but the fix shipped with no public security advisory attached, and outside reporting has since found the vendor's own advisory records don't clearly cover either of the Claude Code findings. That matters because most teams only update a tool urgently when a CVE or advisory tells them to; a silent line in a changelog is easy to miss.

A feature meant to save developers a few keystrokes turned into an automatic way to hand a stranger the keys to your machine — and nobody had to click anything for it to happen.

Why this should worry Indian dev teams specifically

India has one of the largest developer populations on GitHub of any country, and a huge share of that work runs through exactly the environments GitSpawn targets: IT services engineers pulling client codebases off shared drives, freelancers on Upwork and Fiverr accepting zipped "sample projects" from strangers, and campus placement drives where candidates are handed assignment repos over email or a pen drive. Shared office systems and cloud-synced project folders — common in outsourcing setups — are precisely the delivery paths that skip a normal git clone and let a poisoned .git/config survive intact. A single compromised laptop in a services firm handling client data isn't just an individual's problem; under India's Digital Personal Data Protection (DPDP) Act — the law that governs how Indian companies must handle personal data — a leak of client credentials or user data through a hacked developer machine could count as a reportable breach.

What to actually do about it

1. Update your AI coding agent now — don't assume auto-update caught a silent patch.
2. Treat any project you didn't create yourself as untrusted until proven otherwise, especially if it arrived as a ZIP, a drive link, or a pen drive rather than a proper git clone.
3. Before opening an unfamiliar repo in an AI-powered editor, inspect its .git/config file in a plain text editor first — a fsmonitor or hooks entry pointing to an unfamiliar script is a red flag.
4. Open unknown or take-home-assignment repos inside a disposable virtual machine or container rather than your main dev environment.

AI coding agents got popular because they remove friction — you open a folder and they just start helping. GitSpawn is a reminder that the friction was doing some quiet security work too. Until every one of these tools starts treating a repository's own configuration as something that could be lying to it, "just opening a project" is no longer the safe default it used to be.