AI 安全
GitSpawn Exploits Repository-Local Git Configuration to Bypass Execution Approvals in Seven Coding Agents
Malicious projects can place commands in `.git/config` under `core.fsmonitor`, then wait for an agent to run `git status` or `git diff` in the background to execute them on the host. Some products have been patched, but the incident shows that tool approvals can still be bypassed by underlying programs if an agent’s sandbox does not cover startup and version-control processes.
On September 4, the Cloud Security Alliance summarized the GitSpawn vulnerability family disclosed by Manifold Security: Claude Code, Codex, Cursor, Goose, Qwen Code, Grok Build, and Hermes Agent have all had related attack paths. The issue is not prompt injection against the model. Instead, agents automatically invoke Git before the user enters a command in order to establish workspace context.
Git’s `core.fsmonitor` was originally designed as a performance feature for large repositories. In addition to a Boolean value, it can accept the path to an external helper. If a project is copied to a computer together with its existing `.git/config`, operations that refresh the index, such as `git status`, may execute an attacker-specified program with the current user’s privileges. Because the subprocess is launched by Git rather than through a tool call requested by the model, it may bypass the agent’s command approvals, audit logs, and sandbox policies—and may even run before a “trust this workspace” prompt appears.
This is not an attack that can spread through a standard `git clone`: Git does not copy the source repository’s local configuration from the remote. The risk primarily arises from delivery methods that preserve the entire `.git` directory, including ZIP archives, shared drives, synchronized folders, backups, and USB devices. At the time of disclosure, four of the eight findings remained unpatched, although their status may change quickly as new versions are released.
Codex’s public source code demonstrates a more comprehensive mitigation: internal Git commands override `core.fsmonitor`, retaining the feature only when its value is confirmed to be the Boolean `true` and Git supports the built-in daemon; in all other cases, it is forced to `false`. Engineering teams should not merely update their agent versions. They should also inspect `.git/config` before opening untrusted projects, include agent startup, indexing, plugins, and VCS helpers within the same threat model, and search for other Git options that can trigger external programs through repository configuration.