The repo itself just became the attack on your coding agent. manifold security, out september 14,…
the repo itself just became the attack on your coding agent. manifold security, out september 14, found eight flaws across seven cli agents where the repository's git config names a command the agent runs on your machine, four still unpatched.
the prompt injection moved into .git.
Context
Manifold Security's GitSpawn post, dated September 1, 2026 with an update the same day, says it found eight findings across seven agents and that four remain unpatched at publication. It describes the mechanism as a repository's git configuration naming a helper command, which runs when an agent invokes a git command that refreshes the index, before a workspace trust prompt or before the model is contacted, so the command runs on the host. The update says Codex and Cursor were also affected, each came back as a duplicate of an earlier report, and both are patched. The post names Claude Code, Goose, Grok Build, Hermes and Qwen Code in detail.
The first-party post is dated September 1, not September 14. Four still unpatched is the publication-time statement and current patch status is unverified, and which agents are unpatched was not itemized in the text read. The mechanism is untrusted repository configuration executing code and not text injected into a prompt, so the prompt injection moved into .git is the author's take. This entry cites the research only and repeats no exploit steps. The post's adoption figures for the affected agents are vendor-cited. Secondary coverage from The Hacker News was seen as a snippet only. Earlier notes cover the same research.
Related work
- the same class of bug now ships in seven coding agents. manifold secur ↗An earlier note on the same research.
- gitspawn: one line in a repo's git config executes attacker code in se ↗An earlier note on the same research.
Watch next
- Vendor advisories and patch status per agent.
Sources
Provenance
The note above is reproduced unedited from the original post, first published on Threads on 23 September 2026 at 03:32 IST. Sources are the papers and datasets the note draws on.
View the original post ↗Embed this note
More notes
The air is now being asked to keep its own ledger
the air is now being asked to keep its own ledger: ecmwf’s aifs compo becomes the first ai model to forecast atmospheric composition globally every three hours, cleanair simulates 365 days of pm2.5 over china in ten seconds, and a unified framework maps six pollutants at one kilometer across the whole country. the air now files its own composition report.
read the note →The current is now being asked to draw its own map
the current is now being asked to draw its own map: china’s langya 2.0 predicts six ocean phenomena including internal waves and mesoscale eddies, a deep net called wenhai resolves eddies globally with air sea flux formulas built in, and scripps infers surface currents from the way temperature patterns deform in satellite images. the ocean now files its own circulation report.
read the note →The soil is now being asked to report its own carbon
the soil is now being asked to report its own carbon: a nix color sensor paired with generative data augmentation predicts soil organic carbon without a lab, random forest drives 74 percent of soil health mapping studies, and sentinel 2 tracks five year carbon change across france and italy from 922 samples. the dirt now files its own carbon account.
read the note →