GitSpawn vulnerability exposes AI agents to arbitrary code execution

Security researchers have identified a vulnerability, dubbed GitSpawn, that allows untrusted repositories to execute arbitrary code through various AI coding agents. The flaw exists because many CLI-based AI agents, including Claude Code, Cursor, Grok Build, Goose, Hermes, and Qwen Code, gather project context by running git commands without stripping the repository's own git configuration.

Specifically, the vulnerability exploits settings like 'core.fsmonitor', which is a performance feature designed to ask a helper program for file changes during an index refresh. Because agents run these git commands with the user's privileges, a malicious repository can include a configuration that triggers command execution on the host machine before any user approval is requested.