---
title: "AI coding agents run a repo's own code before you approve anything"
url: https://wakenex.com/notes/ai-coding-agents-run-a-repos-own-code-before-you-approve/
language: en
type: note
section: "Signal"
published: 2026-10-20T22:22:08+07:00
author: "WAKENEX"
id: "note:ai-coding-agents-run-a-repos-own-code-before-you-approve"
x_post: https://x.com/AAwakened32198/status/2112565033582657553
alternate_language: https://wakenex.com/notes/ai-coding-agents-run-a-repos-own-code-before-you-approve/index.zh.md
license: "© WAKENEX. You may quote and summarise with attribution and a link to the canonical URL."
cite_as: "WAKENEX. \"AI coding agents run a repo's own code before you approve anything.\" wakenex.com, 2026-10-20. https://wakenex.com/notes/ai-coding-agents-run-a-repos-own-code-before-you-approve/"
---

# AI coding agents run a repo's own code before you approve anything

**In one line:** AI coding agents run a repo's own code before you approve anything

![A hand's finger hovers over one small glowing switch, the 'allow' it has not yet pressed — but the switch is already linked to a towering mechanical stamping arm that has slammed down behind it, flinging a long smear of black ink racing across a pale sheet off into the dark. The small decision was never ahead of the machine it controls.](https://wakenex.com/assets/notes/ai-coding-agents-run-a-repos-own-code-before-you-approve/cover-1600.jpg?v=0ee47564ef)
*Image: WAKENEX*

Qwen Code, Grok Build and two others are still unpatched.

The sandbox that's supposed to protect you is exactly what fails. ↓

OUR READ
The danger from AI coding agents isn't a smarter model. It's leverage. Automating "just read the repo" turns attacker-controlled config into privileged execution before any human clicks allow.

WHAT HAPPENED
→ Sep 1: Manifold Security disclosed GitSpawn — 8 flaws across 7 command-line agents (Claude Code, Codex, Cursor, goose, Hermes, Qwen Code, Grok Build).
→ A repo's own .git/config can name a command via Git's core.fsmonitor; the agent runs git on open and executes it with your privileges, outside the sandbox, before the trust prompt.
→ Sep 4 (Cloud Security Alliance): 4 of the 8 variants were still unpatched.
→ Oct 6: researchers showed GitHub Copilot CLI leaking local secrets in 28 seconds via crafted content.

WHY IT MATTERS
A lever amplifies whatever you point it at — verified work and untrusted input alike. Whoever ships auto-run-git-for-context holds the lever; the developer carries the blast radius.
The guardrail that fails here isn't capability, it's containment.
Second-order: teams bolt scanners and throwaway VMs onto every run, taxing the speed that justified the agent.

BEST CASE AGAINST US
Containment is narrower than the headline. The attack needs a repo arriving as a file transfer with .git intact, not a normal git clone; 4 agents are patched; there's a one-line interim fix; no in-the-wild abuse, none in CISA's exploited-vulnerabilities list.

DO THIS WEEK
Open untrusted repos in a throwaway VM with no saved credentials, and confirm your agent patched the fsmonitor variant. Treat "it's sandboxed" as unproven until you test it.

Our read is wrong if every remaining GitSpawn-class flaw gets patched across all seven agents and CISA's catalog still lists no in-the-wild abuse.

## Sources & notes

- [Source: adversa.ai/blog/top-ai-coding-agent-security-resources-october-2026](https://adversa.ai/blog/top-ai-coding-agent-security-resources-october-2026/)
- [Source: labs.cloudsecurityalliance.org/research/csa-research-note-ai-coding…](https://labs.cloudsecurityalliance.org/research/csa-research-note-ai-coding-agent-git-config-rce-20260904-cs/)
- [Source: aviatrix.ai/threat-research-center/malicious-git-configs-ai-agents-…](https://aviatrix.ai/threat-research-center/malicious-git-configs-ai-agents-cve-2026-19592/)

---
Cite as: WAKENEX. "AI coding agents run a repo's own code before you approve anything." wakenex.com, 2026-10-20. https://wakenex.com/notes/ai-coding-agents-run-a-repos-own-code-before-you-approve/

Web page: https://wakenex.com/notes/ai-coding-agents-run-a-repos-own-code-before-you-approve/