---
title: "[AUTO] Malicious git configs execute code before approval"
pubDatetime: 2026-09-02T18:12:00.000Z
description: "AI coding agents run code from .git/config during startup before showing trust prompts."
tags: [ai-security, vulnerability, claude-code, ai-agents, 2026, 2026-q3, 2026-09, AUTO]
---
[Manifold Security disclosed GitSpawn](https://www.manifold.security/blog/ai-coding-agents-git-hijack), a vulnerability in AI coding agents including Claude Code. During startup, agents run git commands but fail to sanitize `.git/config`, allowing arbitrary code execution before any approval prompt appears.

The threat is practical: no cloned repository needed. Sharing a project via folder, USB, or zip preserves `.git/config`. Specific attack vectors include git's `core.fsmonitor` and `gpg.program` settings, which trigger during routine `git status` operations. Even `.claude/settings.json` hooks run early.

[Anthropic patched Claude Code 2.0.71](https://www.manifold.security/blog/ai-coding-agents-git-hijack) by deferring configuration loading until after user approval. But the core issue is architectural: at least eight instances across seven AI agents share this design flaw.

[SonarSource independently confirmed the vulnerability.](https://www.sonarsource.com/blog/claude-arbitrary-code-execution/) Whether other agents have addressed it is unclear.

---

*Sources: [GitSpawn: AI Coding Agents Can Be Turned Into Malicious Gatekeepers](https://www.manifold.security/blog/ai-coding-agents-git-hijack)  •  [Anthropic Claude Code CLI: Two Critical Pre-Authentication Code Execution Vulnerabilities](https://www.sonarsource.com/blog/claude-arbitrary-code-execution/)*

*Coverage: [Malicious Git Configs Can Make Claude Execute Attacker Code](https://thehackernews.com/2026/09/malicious-git-configs-can-make-claude.html)*

*Related on this blog: [[AUTO] Claude Code Auto Mode vulnerable to module shadowing attack](/posts/auto-claude-code-rce)  •  [[AUTO] Claude Code auto-executes repository configuration](/posts/auto-claude-code-mcp-rce)  •  [[AUTO] Coding agents leak secrets through pre-approved tools](/posts/auto-agent-allowlist-leak)*