GitSpawn
A novel attack vector targeting AI coding assistants in which prompt injection instructions are embedded within code repository files to manipulate AI coding agents into executing malicious code in the developer's local environment. It represents a canonical form of indirect prompt injection.
Timeline (last 90 days)
As of September 1, 2026, four of GitSpawn's eight findings remain unpatched.
GitSpawn's trigger timing precedes the workspace trust dialog prompt, because git status is often initiated by the agent's background context-gathering phase, and the host has not included this path in the execution surface requiring authorization.
The GitSpawn attack causes the attack to occur before the code is explicitly executed, breaking the traditional security principle of "don't run untrusted code."
Prompt injection is divided into two types—direct injection and indirect injection—and GitSpawn is essentially a form of indirect prompt injection.
GitSpawn renders traditional supply chain defenses such as hash verification and code signing ineffective, because the malicious content is legitimate text rather than executable code.
Traditional static code analysis tools lack effective detection capabilities for malicious prompt injection instructions in metadata, documentation, and configuration files.
All Facts (6)
As of September 1, 2026, four of GitSpawn's eight findings remain unpatched.
50%UnverifiedGitSpawn's trigger timing precedes the workspace trust dialog prompt, because git status is often initiated by the agent's background context-gathering phase, and the host has not included this path in the execution surface requiring authorization.
50%UnverifiedThe GitSpawn attack causes the attack to occur before the code is explicitly executed, breaking the traditional security principle of "don't run untrusted code."
50%UnverifiedPrompt injection is divided into two types—direct injection and indirect injection—and GitSpawn is essentially a form of indirect prompt injection.
50%UnverifiedGitSpawn renders traditional supply chain defenses such as hash verification and code signing ineffective, because the malicious content is legitimate text rather than executable code.
50%UnverifiedTraditional static code analysis tools lack effective detection capabilities for malicious prompt injection instructions in metadata, documentation, and configuration files.
50%