Your Code Repository Is Now an Attack Surface
- - GitSpawn showed that a project's settings can trigger an attacker's program when an AI coding agent opens the folder.
- - Manifold Security documented findings across widely used coding agents, including Claude Code, OpenAI's Codex and Cursor.
- - The attack depends on how the project folder reaches the agent.
- - Patch available updates and treat outside project folders like email attachments.
I have built for the web since 1994. My consulting work includes how companies are understood on the web and by AI, along with content strategy, web architecture, AI-visibility research and custom agent systems.
On September 3, 2026, the Cloud Security Alliance published a research note on GitSpawn, a class of flaw disclosed by Manifold Security. An AI coding agent can run an attacker's program as soon as it opens a project folder. The research note describes the flaw.
The takeaway
Check whether agents are patched, and control which project folders they can open.
How can opening a project run an attacker's program?
Developers use Git to record code changes. A repository holds a project's code and its history. In its settings file, a repository can specify a helper program that Git runs while updating its file index, which tracks the project's files.
AI coding agents run commands such as `git status` in the background when they open a project. If the repository's settings name a planted program, that routine check runs it. The agent does not need to ask for approval, and the user does not need to type a prompt.
The risk begins before the user asks the agent to change code. A person may think the agent is only looking through files, while Git runs an instruction stored in the repository. Business leads need to know which folders agents can open. Technology leads need to check whether those agents have patches.
Which agents did the research cover?
The research covered seven widely used coding agents. Manifold documented eight findings, including findings in Claude Code, OpenAI's Codex and Cursor. The Cloud Security Alliance note provides the published details.
Several vendors shipped patches. At the time of the note, some agents were still unpatched. A team deciding whether to use an agent should check its patch status before opening a project from outside its usual development process.
Which project folders can carry this attack?
The attack needs a project to arrive as files with its hidden `.git` folder intact. A shared archive, a synced drive or a USB stick can preserve that folder. An ordinary `git clone` does not copy those settings, so it does not bring along this particular setup.
A folder may look like source code while also carrying Git history and settings. Staff deciding whether to open it in an agent need to know how it arrived, not only who sent it or what it is called.
Treat a project folder from outside your organization like an email attachment. Pause before granting an agent access when the folder's source or delivery route is unclear.
What should teams do now?
Check which agents have patches and apply available updates. Include project origin in the decision about whether an agent should open a folder. Staff should know where repositories come from and whether a project folder arrived through an ordinary clone or as copied files that may retain its `.git` settings. When the route is unknown, hold the folder back until someone checks it.
The boundary for this attack is specific: the project must arrive with its hidden `.git` folder intact. Teams can use that condition when deciding which incoming folders need review before an agent opens them.
Common questions
Does this mean AI coding agents should be turned off?
The findings concern a project folder with specific Git settings, not every use of every agent. Check patch status before deciding whether to keep an agent in use.
How can I check whether an agent has a patch?
Check the vendor's current update information for the agent your team uses, then compare it with the installed version. The note's status reflects when it was published, so use a current vendor check when making an update decision.
What should an employee do with a project folder from outside the company?
Ask how it arrived and whether it came as a clone or as copied files. If the route is unclear, treat the folder like an email attachment and hold it back from the agent until someone checks it.
I help teams plan where agents fit and build custom agent systems; contact me to discuss your setup.