Your agent ran git. So did the repo

Description and use

GitSpawn shows how AI agents can execute arbitrary commands via .git/config, bypassing sandboxes. Fixes involve checking config files before opening and disabling core.fsmonitor.

Problem

AI coding agents invoke git commands in the background, and git reads configuration from the repository’s own .git/config. A malicious config can cause git to execute arbitrary commands, bypassing the agent’s sandbox and approval prompts.

Outcome

The GitSpawn vulnerability demonstrates that background git operations can execute arbitrary commands via .git/config, bypassing agent sandboxes. Mitigations involve pre‑checking config files, disabling fsmonitor, and testing with malicious repositories.

Workflow

• 1. Receive a repository as files (zip, shared drive, USB, etc.).
• 2. Open the repository in the IDE or agent.
• 3. The tool runs background git status, diff, and blame commands.
• 4. Git reads .git/config and executes core.fsmonitor if present.
• 5. The malicious command runs with the user’s privileges.
• 6. The agent’s sandbox is bypassed, allowing arbitrary code execution.
• 7. Mitigation: check .git/config for program‑naming settings before opening.
• 8. Disable core.fsmonitor with git -c core.fsmonitor=false in all git calls.
• 9. Add a test repository with a malicious fsmonitor to the codebase.

Evidence

Coding agents call git all the time. Not when you ask them to commit: in the background, to gather context. What changed, what branch you are on, what the diff looks like.

Source

git reads its settings from the repository's own .git/config. Some of those settings name a program to run. The one Manifold used is core.fsmonitor, a hook git calls to ask "which files changed?" whenever it refreshes the index.

Source

Because it is the agent's own code spawning git, not the model asking for a tool call, it runs "outside the sandbox, without an approval prompt."

Source

I wrote the test: a repository with core.fsmonitor set to a command that drops a marker file, opened the way Reado opens it. Stock git ran the command. Reado's git calls ran it too.

Source

The fix is the one Manifold recommends for vendors, git -c core.fsmonitor=false …

Source