Get the latest tech news

GitSpawn: Untrusted repos can execute code via AI coding agents


Popular CLI AI coding agents run git commands on startup. A repo you were sent can hijack them to run code on your machine, no clicks required.

None

Get the Android app

Or read this on Hacker News

Read more on:

Photo of Code

Code

Photo of coding agents

coding agents

Photo of GitSpawn

GitSpawn

Related news:

News photo

OKF Agent Memory – Git-native persistent memory for AI coding agents

News photo

Apple is working on two unreleased game controllers, according to macOS 26.7 code

News photo

Apple Is Testing a Four-HomePod Surround System, Code Suggests