git

1 post · all tags

  • GitSpawn: How a .git Folder Can Run Code Before Your AI Agent Asks Permission

    AI coding agents run git commands in the background all the time. Not because you asked — because git status and git log are how the agent figures out what it’s looking at when it opens a project. No approval prompt, because they’re “just reads.”

    Manifold Security showed that assumption is wrong. A project folder can carry a .git/config line that turns the agent’s very first orientation step into arbitrary code execution — before the workspace-trust prompt, outside the agent’s sandbox, running with your own user permissions. They call the bug class GitSpawn, and it hit seven AI coding tools, including Claude Code, Cursor, and Codex.