Cloning was the safe part — GitSpawn runs below the approval prompt, and Article 32 asks you to test the control

A vulnerability class in AI coding agents executes from a repository's own git config, beneath the approval and logging layer, and the vector is the copied folder rather than the clone. The EU rule that bites is not the AI Act but GDPR Article 32(1)(d).

Post

A client sends you a zip of their repository. You unzip it, open the folder, and your coding agent starts up.

That was the whole exploit.

On 1 September 2026 Manifold Security published GitSpawn: eight findings across seven AI coding agents — Claude Code, Codex, Cursor, goose, Qwen Code, Grok Build and Hermes. A repository's .git/config can name a program in core.fsmonitor, and git runs it on every index refresh. Agents call git status at startup. It runs as you, outside the agent's sandbox, before any approval prompt. Manifold: "The permission model never sees it."

Three things people are getting wrong:

  1. It is not about cloning sketchy repositories. Cloning a hostile URL does nothing, nor does fetch or pull — git does not copy a remote's config. It has to arrive as files with .git inside: a zip, a shared drive, a sync folder, a USB stick. The path that feels safest is the one that carries it.

  2. It is not a model problem. No prompt injection, no jailbreak — just the subprocess an agent spawns to orient itself.

  3. It is not over. Four of the eight findings were still live on 1 September, more than sixty days after the earliest report went in. One went six contacts across five channels without a triage.

The EU angle is not the AI Act. Your IDE is not on an Annex III path, and the Digital Omnibus moved that chapter to 2 December 2027 anyway. What bites today is GDPR Article 32 — specifically 32(1)(d), "a process for regularly testing, assessing and evaluating the effectiveness" of your measures. If your TOMs say the agent asks before it runs commands, that control did not exist for this class. And Article 33's seventy-two hours runs from awareness. A control that cannot see the event cannot start the clock.

What I would do Monday:

  1. Inventory every repository that arrived as a file, not a clone.
  2. Read .git/config before an agent touches the directory — any key naming a program can run it.
  3. Wrap the launcher: git -c core.fsmonitor=false status.
  4. Pin agent versions and re-test — four of the eight were still open.

A prompt you answer is a control. A subprocess you never see is not. Only one of the two is written in your risk file.

Which one are you relying on?

#EUAIAct #AgenticAI #GDPR #AppSec #AICompliance

AI disclosure: the narration voice, the cover art and the brand ident animation in this video are AI-generated. The script, the claims and the source checks are mine.

First comment

Sources.

Manifold Security's disclosure, 1 September 2026 — the primary post, with the mechanism, the per-agent findings and the disclosure timeline. https://www.manifold.security/blog/ai-coding-agents-git-hijack

The Hacker News, 2 September 2026 — independent write-up, adds the affected and fixed version numbers per product. https://thehackernews.com/2026/09/malicious-git-configs-can-make-claude.html

Cloud Security Alliance CISO briefing, 4 September 2026 — useful because it dates the disclosure to the 4th; the primary post is the 1st. https://labs.cloudsecurityalliance.org/research/ciso-daily-briefing-20260904/

git config documentation — core.fsmonitor, so you can see for yourself that it takes a command and that index refresh runs it. https://git-scm.com/docs/git-config

GDPR Article 32, security of processing — the testing-effectiveness duty is 32(1)(d). https://gdpr-info.eu/art-32-gdpr/

GDPR Article 33 — the seventy-two hours runs from awareness, which is the part a blind control costs you. https://gdpr-info.eu/art-33-gdpr/

One point cut for length: this shape is not new. Trust-dialog bypasses of exactly this kind were fixed in VS Code and in the JetBrains IDEs years ago, and Manifold notes an earlier fix in one agent that a later release regressed. The lesson is not that agent vendors are careless. It is that "we ask before we execute" is a promise about one code path, and the context-gathering path is a different one.

AI disclosure: the narration voice, the cover art and the brand ident animation in this video are AI-generated. The script, the claims and the source checks are mine.

Claims

Sources

Corrections

Aggregator listings date the GitSpawn disclosure 4 September 2026. Manifold Security's own post is dated 1 September 2026, and this edition uses 1 September throughout; the sixty-day figure is counted from the earliest report, 26 June 2026.

Four CVE identifiers are in circulation for this cluster. Only CVE-2026-72718 (goose) and CVE-2026-71963 (Hermes Agent) appear in the primary disclosure, so no CVE numbers are used in the post or the video.

The core.fsmonitor mechanism was verified by direct reproduction on git 2.43.0 rather than from documentation, because the git-config page did not return the configuration-variable section on extraction.

AI disclosure

The video for this edition contains AI-generated media: the narration is a synthetic voice, and the cover art and the brand ident animation are generated. The script, the claims and the source verification are human-authored and human-checked. Assets carry IPTC DigitalSourceType and C2PA Content Credentials.