Skip to content
Sign in
Artwork for [Dev]olution
[Dev]olution · Wednesday · 16 min

How Can a Zip File Hijack Your AI Coding Agent?

You unzip a folder from a contractor, type your AI agent’s name, and before you write a single prompt, somebody else’s code is already running on your machine as you. That’s GitSpawn, a flaw Manifold Security found across seven popular AI coding agents. The unsettling part is that nothing was broken or cleverly manipulated. Every agent did exactly what it was built to do. In this solo episode, Nicky Pike of Coder pulls from his Air Force years as a C-141 crew chief to explain why the developer laptop has become the most privileged and least governed place in your company to run an agent. He also digs into why three of the biggest agent vendors just shipped the same answer, and what their own docs quietly say you’re now on the hook for. If your agents are running on laptops tonight, this is the episode to hear before they touch anything that matters. In this episode, you'll learn: Why a zipped repo can run code as you when a clean clone can’t What still leaves your network when vendors run agent work on your machines How to tie every agent run back to the human who kicked it off Things to listen for: (00:00) The zip file that runs code as you (00:55) What an agent does the second it starts (01:40) Seven agents and one flaw in the plumbing (02:15) The cleanup script that wiped 48,000 files (03:10) Lessons from a C-141 flight line (04:20) The 10 mil socket that grounded every jet (05:05) Four questions for every AI agent (05:35) Walking the line on a developer laptop (06:35) Attackers are shopping for agent setups (07:25) Three vendors ship the same answer (09:00) What still leaves your network (09:45) The fine print in every vendor’s docs (11:05) Why nobody solved the flight line for you (12:25) What to change on Monday (14:20) Final thoughts: whose flight line is this? Resources: Nicky Pike’s LinkedIn: https://www.linkedin.com/in/nicky-pike/ Coder website: https://coder.com/ GitSpawn: Malicious Git Configs Hijack AI Coding Agents

0:00-16:07
Play in

transcript

No transcript — this publisher did not publish one.

show notes

You unzip a folder from a contractor, type your AI agent’s name, and before you write a single prompt, somebody else’s code is already running on your machine as you.

That’s GitSpawn, a flaw Manifold Security found across seven popular AI coding agents. The unsettling part is that nothing was broken or cleverly manipulated. Every agent did exactly what it was built to do.


In this solo episode, Nicky Pike of Coder pulls from his Air Force years as a C-141 crew chief to explain why the developer laptop has become the most privileged and least governed place in your company to run an agent. He also digs into why three of the biggest agent vendors just shipped the same answer, and what their own docs quietly say you’re now on the hook for.

If your agents are running on laptops tonight, this is the episode to hear before they touch anything that matters.

In this episode, you'll learn:

  1. Why a zipped repo can run code as you when a clean clone can’t
  2. What still leaves your network when vendors run agent work on your machines
  3. How to tie every agent run back to the human who kicked it off

Things to listen for:

 (00:00) The zip file that runs code as you
 (00:55) What an agent does the second it starts
 (01:40) Seven agents and one flaw in the plumbing
 (02:15) The cleanup script that wiped 48,000 files
 (03:10) Lessons from a C-141 flight line
 (04:20) The 10 mil socket that grounded every jet
 (05:05) Four questions for every AI agent
 (05:35) Walking the line on a developer laptop
 (06:35) Attackers are shopping for agent setups
 (07:25) Three vendors ship the same answer
 (09:00) What still leaves your network
 (09:45) The fine print in every vendor’s docs
 (11:05) Why nobody solved the flight line for you
 (12:25) What to change on Monday
 (14:20) Final thoughts: whose flight line is this?


Resources:

links3

more episodes

All episodes