GitSpawn flaw affects seven AI coding agents, four still unpatched

Sep 16, 2026 · Issue 7 · 2 sources, 2 articles

A vulnerability called GitSpawn affects seven AI coding agents, four of which have no fix yet. Researchers say the focus is shifting from prompt injection to other attack surfaces.

Who is affected and how

senior developer

Before opening untrusted git repositories, check how the agent handles them.

Narrative: The coding agent is the new attack surface

Sources

• GitSpawn Flaw Hits 7 AI Coding Agents, 4 Unpatchedshattered.io · Sep 16, 2026
• AI coding agents' 0-click RCE flaw could hand attackers keys to the kingdomtheregister.com · Sep 17, 2026

Machine-generated summary based on the titles and excerpts of the source articles. The facts come from the linked article.