Case · DiggingBeagle record
Manifold Security disclosed a cross-vendor vulnerability class in which AI coding agents automatically ran Git commands while opening a repository and preserved attacker-controlled repository-local Git configuration. Command-bearing settings such as core.fsmonitor could therefore execute code as the developer before normal model, trust or tool-approval controls.
Defensive cross-vendor vulnerability research. The documented delivery condition is narrower than a hostile git URL: the victim must receive a project directory with attacker-controlled local .git configuration intact, such as an archive, shared volume, sync directory or copied workspace. Ordinary clone, fetch and pull do not transfer the source repository's .git/config. Product patch status is a dated September 1, 2026 snapshot unless a vendor advisory establishes otherwise.
GitSpawn sits below the model layer. Coding agents commonly run Git commands automatically to learn branch, index and diff state. Manifold Security found that multiple products performed those context-gathering calls without neutralizing repository-local Git settings that can name executable helpers.
The clearest path uses core.fsmonitor. During index refresh, Git can run the helper configured in the repository's own .git/config. If a received workspace arrives with that metadata already present, an affected agent can trigger the command during startup, review preparation, the first message or even the first keystroke. Because the subprocess belongs to the agent application's own context-gathering code rather than an LLM tool call, it can run outside the model-tool sandbox and before the normal trust or approval boundary.
Manifold reported eight findings across seven coding agents. At publication, four had been fixed and four remained open; the mechanisms were not identical in every product, and one Claude review-path key was deliberately withheld while unpatched. The Goose maintainer advisory provides a vendor-confirmed instance of the class: goose review before 1.44.0 could run a repository-controlled core.fsmonitor command before contacting the model.
The attack requires attacker-controlled .git configuration to be present on disk, which can happen through an archive, shared/synced directory, copied workspace, nested repository or similar file transfer.
Boundary: external project / developer workstation
An affected agent invokes Git for status, diff or related context before or around the user's first explicit agent action.
Boundary: workspace open or review / agent application
In the common disclosed path, index refresh consults core.fsmonitor in .git/config and starts the repository-selected helper.
Boundary: repository metadata / Git subprocess
The command is spawned by application context gathering, so the model tool sandbox and approval layer may never observe or authorize it.
Boundary: agent plumbing / developer host authority
The process runs as the user; the Goose advisory specifically notes inherited environment secrets and provider API keys as accessible impact.
Boundary: developer process / credentials and local repositories
Manifold says the finding was closed as a duplicate of a same-day report and later fixed by 2.1.196.
Alibaba SRC accepted the report; Manifold still reproduced it on 0.22.3 on September 1.
The report was closed as a duplicate of an earlier finding and was patched before publication.
The Goose variant was acknowledged and later tracked as CVE-2026-72718.
Manifold says it duplicated a July 1 report and remained reproducible on 1.0.13 on September 1.
This distinct Git configuration sink was closed as a duplicate of an internal ticket and remained reproducible on 2.1.252 on September 1.
Manifold says Codex was patched; Hermes remained unpatched at the September 1 retest and was assigned CVE-2026-71963 by VulnCheck.
GHSA-r5pp-p5r8-466r identifies versions before 1.44.0 as affected and 1.44.0 as patched.
The disclosure reports eight findings across seven agents, with four findings still open at that dated snapshot.
Locator: Delivery discussion explaining archives, shared drives, sync folders and USB copies versus git clone
Locator: Affected versions, Patched versions and CVE ID fields
Locator: Sections 'The git you didn't run' and core.fsmonitor explanation
Locator: Summary and Root cause sections for goose review
Locator: TL;DR and per-agent case studies describing execution timing
Locator: Summary: no submitted prompt, model call, tool approval or trust prompt before execution
Locator: TL;DR and 'Eight findings across seven agents' section
Scope: This severity measurement is specific to the Goose variant, not a score for every GitSpawn finding.
Locator: GHSA severity, CVSS v4 vector, CVE ID and CWE fields
Scope: Status is tied to Manifold's September 1, 2026 retest/publication. Later version numbers without a vendor advisory or reproduction do not by themselves establish remediation.
Locator: TL;DR and timeline table: eight findings across seven agents, status at publication
Scope: Potential technical impact described by the advisory; the source does not report realized theft from a malicious in-the-wild exploitation.
Locator: Impact section
A coding agent can execute attacker-controlled host code before the model participates. Security reviews therefore need to include startup discovery, version-control helpers and other application-owned subprocesses, not only model tool calls. A workspace-trust prompt that appears after context gathering is not a boundary for work already performed.
DiggingBeagle. “GitSpawn let received repositories execute code before AI coding-agent trust gates.” First seen Sep 1, 2026. https://diggingbeagle.com/cases/gitspawn-let-received-repositories-execute-code-before-ai-coding-agent-trust-gat/
Citation guidanceWhy this archive exists
DiggingBeagle is a non profit research project documenting AI security incidents, agent failures, vulnerabilities and AI-assisted operations. A case keeps its claims beside the sources that support, contest or limit them. Later updates stay visible, so a reader can see when the account changed.
We publish case reconstructions, dated reporting and analysis across records. Each has a different evidentiary role. About the project and our methodology explain how the work is reviewed.