TL;DR: AI coding agents can run unsanitized git commands during background context gathering, letting a hostile repository trigger arbitrary code execution as the developer before approval prompts, authentication, or sandbox boundaries intervene, according to Manifold Security research. That makes startup plumbing, not the model, the critical control point.
At a glance
What this is: Manifold Security says AI coding agents can execute repository-supplied commands during background context gathering, creating a GitSpawn path to arbitrary code execution on the host.
Why it matters: IAM and endpoint teams need to treat AI coding agents as runtime actors with developer privileges, because the trust boundary can fail before the user even approves the session.
By the numbers:
- Claude Code ships over 77 million npm downloads a month.
Context
AI coding agents increasingly gather repository context by invoking local tools before the user finishes setup, and that changes the security model from model output risk to host-level execution risk. The problem is not that git exists, but that agent startup flows can inherit repository configuration without stripping dangerous settings, which turns a convenience feature into an execution path.
This is a genuine identity and privilege issue because the agent runs as the developer who launched it, often with access to SSH keys, cloud credentials, and local tokens. In other words, a benign-looking project folder can arrive with a hidden control plane inside AI coding agent security-relevant startup behaviour.
Key questions
Q: What breaks when agentic AI is allowed to interpret untrusted repository context?
A: The control assumption that context is passive breaks first. Repository text can steer the agent toward sensitive files, so access decisions must account for semantic influence, not just static file permissions. When that is missing, an attacker can turn ordinary comments and documentation into a path to restricted data.
Q: Why do unsanitised git calls in AI coding agents create code execution risk?
A: Git operations such as status and diff can refresh the index, and the refresh path may execute repository-configured helpers. If the agent passes that config through unchanged, an attacker-controlled workspace can run code on the developer machine. The risk is not the command name alone, but the combination of local trust, inherited privileges, and hidden execution hooks.
Q: How should security teams control agentic AI tools in untrusted repositories?
A: Security teams should run agentic tools in isolated environments with no production secrets, restricted filesystem scope, and tightly controlled network access. Repository content, comments, and file names must be treated as untrusted input because they can steer agent behaviour. The goal is to prevent context from becoming an indirect command channel.
Q: When does an AI coding agent become a higher-risk identity than the developer using it?
A: When the agent can execute local commands, reach environment secrets, and touch repositories before meaningful user approval. At that point the agent is not just assisting the developer. It is acting through the developer’s session with enough delegated authority to expose credentials, alter code, or move laterally into connected systems.
Technical breakdown
Why repository configuration becomes code execution
Git reads local repository settings from .git/config, and some of those settings can name helper programs that git executes during ordinary operations such as status or diff. If an AI coding agent shells out to git without sanitising those settings, the repository can supply a command that runs on the host during index refresh. The critical detail is that the agent did not need to “trust” the repository in any semantic sense. It only needed to invoke a standard git operation that triggers a documented execution sink. Practical implication: treat repository-local git config as executable input and strip or override dangerous keys before any background context gathering.
Practical implication: Sanitise git configuration before any agent invokes repository inspection commands.
Why startup timing defeats normal approval and sandbox expectations
The vulnerability is strongest when the command runs before the user has authenticated, before workspace trust is accepted, or before the first prompt is typed. At that point the agent is not waiting for a model response. It is performing housekeeping on the user’s machine, often outside the sandbox that governs the model session. That distinction matters because permission systems usually control what the model may do, not what the wrapper process does while preparing context. Practical implication: move trust decisions ahead of any subprocess that inspects untrusted repositories, or fail closed until the environment has been normalised. See the AI Agent Authorisation Guide.
Practical implication: Prevent context-gathering subprocesses from running before trust gating completes.
Why these bugs are identity and endpoint problems, not just application bugs
The impact is execution as the developer, which means the agent inherits the user’s desktop, shell, network, and cloud reach. That makes the bug an identity problem because the abused principal is the human session itself, and an endpoint problem because the payload executes locally with ordinary privileges. Once that happens, SSH keys, cloud credentials, and local tokens become immediately reachable. The control failure is not a missing model safeguard, but an unmanaged privilege boundary between agent orchestration and host execution. Practical implication: treat AI coding agents as privileged desktop software and monitor them with the same scrutiny used for other high-trust developer tooling. See the AI Agent Observability, Audit and Incident Response Guide.
Practical implication: Monitor agent startup behaviour as privileged endpoint activity.
Threat narrative
Attacker objective: The attacker wants code execution on the developer machine with enough access to steal secrets, pivot into developer infrastructure, or tamper with source and build workflows.
- Entry occurs when a user opens a hostile repository or workspace that contains a crafted .git directory and malicious configuration.
- Credential access follows when the agent invokes git during context gathering and the repository-supplied helper runs on the host with the developer’s privileges.
- Escalation and lateral movement occur because the process can read local secrets, environment variables, and credentials available to the user session.
- Impact is arbitrary code execution outside the intended sandbox, with access to SSH keys, cloud tokens, and local repositories.
Breaches seen in the wild
- PocketOS database deletion incident: An AI coding agent found an over-privileged Railway API token in the codebase and deleted PocketOS production data and backups in nine seconds.
- Amazon Q Developer extension compromise 2025: An over-scoped CI token let an attacker ship a prompt telling Amazon Q's AI coding agent to wipe files and AWS resources (CVE-2025-8217).
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
GitSpawn is a privilege boundary failure, not a model failure. The unsafe behaviour sits in the wrapper process that prepares context, not in the model that generates text. That means conventional prompt-safety thinking misses the real issue, which is whether the agent can inherit and execute repository-controlled behaviour before the user has granted meaningful trust. For practitioners, the right question is where the first subprocess runs and whose authority it inherits.
AI coding agents are becoming high-trust execution environments. The article shows that these tools act like developer workstations with extra automation, not like simple chat interfaces. That changes governance because the user session now combines code execution, credential access, and repository trust in one place. Teams should treat the agent runtime as part of the privileged computing estate, not as a harmless assistant layer.
Identity governance must extend to the machine acting on behalf of the developer. When an agent can touch repositories, tokens, and shells before any prompt is accepted, the real control question is delegated authority. Agent ownership and lifecycle matters here because unmanaged agent use creates a shadow control surface that existing IAM reviews do not see.
The security gap is unsanitised inherited state. The repository supplied the command, and the agent supplied the authority to run it. That combination creates a reusable pattern across products, so the issue is not one vendor’s mistake but a class of startup-time trust failures. Practitioners should model any agent that shells out to local tools as a potential execution broker, not just a consumer of prompts.
From our research library:
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
- Read next: AI Coding Agents Security Guide
What this signals
GitSpawn shows that agent governance now has an execution-time problem. Access control on the tool is not enough if the wrapper can run local commands before a trust decision is made. For teams adopting coding assistants, the first control question is whether repository content can influence host execution before the agent has been fully admitted into the session.
Identity governance for AI agents has to include startup provenance. The important issue is not just who can invoke the agent, but what state the agent inherits when it starts. That is why lifecycle controls, ownership, and offboarding need to cover local configuration, not only API permissions and model access.
Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025. That figure is a reminder that the surrounding workflow is already producing secret exposure, so context-gathering bugs compound an existing operational problem rather than creating a new one from scratch.
For practitioners
- Inspect repository state before agent startup Check .git/config and other repository-controlled files before opening an untrusted workspace in an AI coding agent, especially when the project arrived as a zip, share, or synced folder.
- Strip dangerous git settings from context-gathering calls Force agent startup commands to ignore repository-supplied execution hooks, including helper settings that can run during status and diff operations.
- Move trust gating ahead of local tool execution Do not let the agent invoke git or other local inspection commands until workspace trust, authentication, and environment controls have completed.
- Treat AI coding agents as privileged endpoints Log and review agent startup subprocesses, because they can expose SSH keys, cloud credentials, and local tokens before the model session formally begins.
Key takeaways
- AI coding agents can turn ordinary repository metadata into an execution path before trust prompts or authentication complete.
- The impact is not limited to the model layer because the host session itself becomes the attack surface, with credentials and local secrets exposed to attacker-controlled code.
- Sanitising repository input and gating local subprocesses are the controls that matter most when agents inspect untrusted workspaces.
Related NHI Mgmt Group resources: AI Coding Agents Security Guide · Identity Governance for AI Agents Guide · AI Agent Observability, Audit and Incident Response Guide · Shadow AI and AI Agent Discovery Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | The article shows agent startup can expose local secrets and credentials through hostile repository input. |
| NHI-04 — Insecure Authentication | The agent runs before trust and authentication complete in some products. | |
| Recommendation — Scan agent startup paths for secret exposure and block repository-supplied commands before context gathering. Move authentication and trust checks ahead of any local inspection commands used by the agent. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Host-side credential exposure makes authenticator handling central to the risk. |
| Recommendation — Protect and rotate exposed authenticators, and prevent local tools from reading them during startup. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The attack path targets credentials and enables movement through the developer environment. |
| Recommendation — Map agent startup abuse to credential access and lateral movement techniques in detection content. | ||
| CIS Controls v8 | CIS-5 — Account Management | The exploit rides on the developer account and its local privileges. |
| Recommendation — Review which accounts can run agents and limit the privileges those sessions inherit. | ||
Key terms
- GitSpawn: GitSpawn is the pattern where an AI coding agent invokes local git commands that execute repository-supplied configuration on the host. The risk is that ordinary context gathering becomes a code execution path before trust prompts, sandboxing, or authentication can meaningfully intervene.
- Workspace Trust: A trust control in code editors that separates passive file viewing from active execution of project-defined tasks. When disabled or bypassed, the editor can run repository instructions in the user’s context, which turns source control content into an execution path.
- Output Sink: An output sink is any downstream destination where an agent's response can cause a real effect, such as a rendered UI element, webhook, message queue, or database write. In agentic systems, sinks are often more important than the text response itself because they are where model output becomes action.
- Delegated Authority Model: A delegated authority model defines who is allowed to approve, review, or execute control-related decisions across the enterprise. It helps ensure requests reach the correct responsible party, especially when control owners, managers, and process owners sit in different teams, regions, or systems.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management in the context of modern automated workflows. It helps security and identity practitioners build durable controls around delegated access and runtime trust.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org