Your AI Coding Agent Runs Git Before You Type. A Zipped Repo Decides What It Runs.

The agent ran the repository's command before it asked whether to trust the repository

A colleague sends you a project as a zip file. You unpack it, open the folder with your AI coding assistant, and before you have typed a character the assistant runs git status in the background to work out where it is. That command reads the repository's own configuration file. If whoever built the zip put a program name in there, it has already run. As you, outside the assistant's sandbox, with nothing on screen.

Manifold Security published this on 1 September 2026 under the name GitSpawn: eight findings across seven command-line AI coding agents, four of them still live at publication. The part worth your attention is not that agents can be tricked. It is that nothing in this attack involves the model at all.

What Manifold found

Offensive security engineer Francisco Rosales started from a narrow question. What does a command-line AI agent actually do in the seconds after it starts? The answer, in every product examined, is that it gathers context about the project by shelling out to git, using commands like git status and git diff. Ordinary things any developer would type themselves.

The mechanism deserves a slow read, because no part of it is a bug. Almost any git command that touches the working tree refreshes the index first, and during that refresh git consults core.fsmonitor. That is a documented performance setting for large repositories, and its value is the name of a helper program git runs to find out which files changed. Git reads the setting from the repository's own .git/config, which is to say from a file the repository carries with itself. So a repository can name a command and the agent's background git call will execute it. The agent's permission model never sees this, because the agent is not asking to run anything. It is spawning a subprocess to use git, and git is doing exactly what git is documented to do. Delivery is the single constraint. Cloning a hostile URL is harmless, and so are fetch and pull, because git never transfers a config file between machines. The repository has to arrive as files with its .git directory intact, which is what a shared archive, a sync folder, a network drive or a USB stick preserves. Consultants hand projects to clients this way. So do colleagues.

• On Claude Code and Hermes Agent the payload fires before the workspace-trust prompt is accepted. On Qwen Code it fires before the user has authenticated. On Grok Build it fires on the first keystroke.
• Fixes shipped for goose (version 1.44.0, carrying CVE-2026-72718 at a severity of 7.0), for Cursor, for OpenAI's Codex, and for one of the two paths in Claude Code. Hermes Agent, Qwen Code, Grok Build and a second Claude Code path were all still executing repository-supplied commands when Manifold retested them on 1 September 2026.
• Whatever runs, runs with the developer's privileges: SSH keys, cloud credentials sitting in the environment, tokens in the shell profile, and every other repository on the disk.

Why it matters

Nobody has been robbed yet. The Hacker News checked CISA's catalogue of vulnerabilities known to be exploited on 2 September 2026 and found none of these identifiers in it. What exists instead is an installed base. Claude Code alone records over 77 million npm downloads a month, and the five projects Manifold wrote up carry close to half a million GitHub stars between them. Your own exposure is narrower than those numbers and more awkward than them. It is the developer who accepts a zip from a client, the contractor working off a synced folder, the engineer restoring a project from a backup drive. Every one of those people can say truthfully that they approved nothing, because on four of these agents the approval prompt had not appeared yet. Endpoint monitoring is no help either, since what it observes is a developer's machine running git, which is the most ordinary thing that happens on it.

The systemic point belongs in your next architecture review. Almost everything spent on securing AI agents so far has been aimed at the model: prompt injection, jailbreaks, filters on what goes in and what comes out. This attack touches none of it. It lives in the subprocess an agent spawns at startup to work out where it is, and the same trust-dialog bypass was patched in Visual Studio Code in 2021 and in JetBrains IDEs shortly afterwards. A new category of tool has rebuilt an old category of mistake at speed. The disclosure record is the other half of the story. Five of Manifold's eight reports came back as duplicates of findings other researchers had already filed independently, one of them on the same day. xAI closed an earlier report of the same class as informative. Nous Research left the Hermes advisory untriaged after six contact attempts across five channels, and the identifier for it was eventually assigned by VulnCheck rather than by the vendor.

What to do about it

1. Set core.fsmonitor to false in the global git configuration on every developer machine today. It costs nothing you need and it closes the most used sink while you are still deciding what the policy should be.
2. Treat any repository that arrived as files rather than as a clone as untrusted input, and read its .git/config before opening it with anything. Look for core.fsmonitor, core.hooksPath and attr.tree, because a clone is safe and an unzipped folder is not, and right now that distinction is invisible to almost everyone who writes code for you.
3. Check the version your agents are actually pinned to against the disclosure, rather than assuming an update carried the fix. Codex is fixed from 0.131.0 while the current release is far newer, so a pinned install can sit below the fix indefinitely, and three of the affected agents have no fix to update to at all.

Bottom line

Manifold put it better than a summary can: the vulnerability is not in the model, or in anything new, but in the ordinary plumbing underneath. Take that to your next security meeting as a scoping question rather than an AI question. If your review of agent tooling covered prompts, permissions and data handling but never asked what the thing executes in the first second after it opens a folder, then the review had a hole in it. So did nearly everyone else's, which is precisely why four of these are still unfixed.