GitSpawn

GitSpawn is a security vulnerability or exploitation technique related to Git repository management and automated code deployment pipelines. It matters for AI governance because many organizations use Git-based workflows to version control and deploy machine learning models, training datasets, and AI system code. Understanding GitSpawn risks helps enterprises prevent unauthorized code injection, data contamination, and supply chain attacks that could compromise the integrity and safety of their AI systems.

1 item

EnforcementGlobal2026-09-08

GitSpawn Hits Seven AI Coding Agents, Exposing Repository Trust as a Systemic Control Gap

Check Point Research has disclosed GitSpawn, a vulnerability class affecting seven AI coding agents including Claude Code, Codex, Cursor, Goose, Qwen Code, Grok Build, and Hermes. The vulnerability exploits how agents process instructions embedded in version control repositories, creating a pathway for secrets exfiltration and prompt injection at the repository layer. The same threat intelligence cycle also documents active exploitation of SonicWall and JFrog products, signaling coordinated attacker interest in AI toolchain and adjacent infrastructure.

GitSpawn Claude Code Codex Cursor Qwen Code Grok Build agentic AI prompt injection secrets management Check Point Research