AI coding agents run a repo's own code before you approve anythingAI 编码 agent 会在你批准任何事情之前，先跑仓库自带的代码

Qwen Code, Grok Build and two others are still unpatched.

The sandbox that's supposed to protect you is exactly what fails.

OUR READ

The danger from AI coding agents isn't a smarter model. It's leverage. Automating "just read the repo" turns attacker-controlled config into privileged execution before any human clicks allow.

WHAT HAPPENED

• Sep 1: Manifold Security disclosed GitSpawn — 8 flaws across 7 command-line agents (Claude Code, Codex, Cursor, goose, Hermes, Qwen Code, Grok Build).
• A repo's own .git/config can name a command via Git's core.fsmonitor; the agent runs git on open and executes it with your privileges, outside the sandbox, before the trust prompt.
• Sep 4 (Cloud Security Alliance): 4 of the 8 variants were still unpatched.
• Oct 6: researchers showed GitHub Copilot CLI leaking local secrets in 28 seconds via crafted content.

WHY IT MATTERS

A lever amplifies whatever you point it at — verified work and untrusted input alike. Whoever ships auto-run-git-for-context holds the lever; the developer carries the blast radius.

The guardrail that fails here isn't capability, it's containment.

Second-order: teams bolt scanners and throwaway VMs onto every run, taxing the speed that justified the agent.

BEST CASE AGAINST US

Containment is narrower than the headline. The attack needs a repo arriving as a file transfer with .git intact, not a normal git clone; 4 agents are patched; there's a one-line interim fix; no in-the-wild abuse, none in CISA's exploited-vulnerabilities list.

DO THIS WEEK

Open untrusted repos in a throwaway VM with no saved credentials, and confirm your agent patched the fsmonitor variant. Treat "it's sandboxed" as unproven until you test it.

Our read is wrong if every remaining GitSpawn-class flaw gets patched across all seven agents and CISA's catalog still lists no in-the-wild abuse.