What happened
A user opens or reviews an attacker-supplied repository, and the coding agent's own Git subprocess evaluates repository-defined configuration that launches attacker-controlled code on the host.
2026-09-01
HighPrimaryGitSpawn: Malicious Repository Configuration Could Run Code Outside Coding-Agent Sandboxes
Manifold Security found eight Git-configuration command-execution paths across seven coding agents, allowing repository-controlled code to run on the host outside agent sandboxes.
AI coding agentsTool execution / MCPRepository-controlled Git configuration triggering host command execution through coding-agent metadata collectionDeveloper workstations running affected AI coding-agent command-line tools against untrusted repository files
Why it matters
Successful exploitation provides code execution with the developer's privileges, potentially exposing local files, SSH keys, cloud credentials, shell tokens, and other repositories available to that account.
Missing authorization check
Repository metadata must be treated as untrusted, and host-side subprocesses must not execute repository-defined commands without a separately enforced authorization decision.
Would PP block it?
The malicious process may still execute on the workstation. Deployments, package publication, protected writes, and infrastructure changes can fail closed if their credentials and enforcement points are outside that workstation and require independently authenticated approval.
Incident analysis
Timeline and technical read
Timeline
2026-06-26
Manifold reports the Claude Code core.fsmonitor path; the vendor later fixes it in version 2.1.196.
2026-07-20
Manifold reports the OpenAI Codex and Hermes findings; Codex is later patched, while the reported Hermes path remains unpatched at publication.
2026-09-01
Manifold publishes GitSpawn, documenting eight findings across seven agents and reporting that four paths remained unpatched.
Technical breakdown
- Affected agents invoked Git internally to collect repository context such as status, branch, or worktree information.
- Those invocations did not consistently neutralize repository-controlled Git configuration keys capable of naming commands.
- Because the agents spawned Git as host subprocesses, configured commands executed outside the agent sandbox and before an approval prompt.
- Manifold demonstrated the class using repository files delivered as archives rather than requiring a victim to clone from an attacker-controlled server.
Authorization boundary
Where the authorization boundary should have been
This incident is categorized as Tool execution / MCP. The relevant Permission Protocol gate is Runtime Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.
- If enforced at
- Credential, deployment, publication, and protected data-mutation boundaries outside the coding-agent host
- Still needs
- Vendor patches, safe Git invocation, repository inspection, endpoint isolation, and credential rotation remain necessary.
- Receipt required for
- Using protected credentials to deploy, publish, merge, or mutate infrastructure after repository code is opened
Permission Protocol cannot prevent the local Git-triggered code execution, but an external Runtime Gate can keep production authority outside the compromised coding-agent process and deny consequential credential-backed actions without a valid receipt.
Start small
Put the relevant gate at this action boundary.
This incident maps to Runtime Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.