Manifold Security disclosed GitSpawn, a vulnerability in AI coding agents including Claude Code. During startup, agents run git commands but fail to sanitize .git/config, allowing arbitrary code execution before any approval prompt appears.
The threat is practical: no cloned repository needed. Sharing a project via folder, USB, or zip preserves .git/config. Specific attack vectors include git’s core.fsmonitor and gpg.program settings, which trigger during routine git status operations. Even .claude/settings.json hooks run early.
Anthropic patched Claude Code 2.0.71 by deferring configuration loading until after user approval. But the core issue is architectural: at least eight instances across seven AI agents share this design flaw.
SonarSource independently confirmed the vulnerability. Whether other agents have addressed it is unclear.
Sources: GitSpawn: AI Coding Agents Can Be Turned Into Malicious Gatekeepers • Anthropic Claude Code CLI: Two Critical Pre-Authentication Code Execution Vulnerabilities
Coverage: Malicious Git Configs Can Make Claude Execute Attacker Code
Related on this blog: [AUTO] Claude Code Auto Mode vulnerable to module shadowing attack • [AUTO] Claude Code auto-executes repository configuration • [AUTO] Coding agents leak secrets through pre-approved tools