Audit .git/config Now: GitSpawn Runs Attacker Code in 4 Unpatched AI Agents

On September 1, security firm Manifold Security published GitSpawn, a research writeup documenting eight vulnerabilities across seven command-line AI coding agents: Claude Code, OpenAI Codex, Cursor, goose, Qwen Code, Grok Build, and Hermes Agent. Four of the eight paths were still unpatched when Manifold re-confirmed them against current releases on September 1. OpenAI has since published three CVEs of its own covering the identical flaw class in Codex, credited to three unrelated research groups, according to The Hacker News.

The flaw class is simple, which is why it matters. AI coding agents run git commands in the background at startup to gather context about the project they were opened in. Those calls run without stripping the repository's own git configuration — and several git settings are command-execution sinks. The repository names a command; git runs it, on the host, with the developer's privileges, before any approval prompt. "The vulnerability is not in the model, or in anything new," Manifold wrote. "It is in the ordinary plumbing underneath, the subprocess an agent spawns at session startup to work out where it is."

How a repository runs code before you type

The main sink is core.fsmonitor, a documented git performance setting for large repositories. Instead of checking every file on disk, git asks a helper program what changed — and runs that helper during an index refresh. Git reads the setting from the repository's own .git/config, so a repository that ships a command inside core.fsmonitor turns every index-refreshing call into code execution: git status, git diff, whichever the agent happens to run.

And agents run them constantly. Manifold's samples include `git status --porcelain=2 --branch` and `git diff --name-only HEAD` — ordinary context-gathering calls. The timing is what turns this into a pre-trust attack surface: on Claude Code and Hermes Agent, the payload fires before the workspace-trust prompt is accepted; on Qwen Code, before the user has even authenticated; on Grok Build, on the first keystroke, before any message is sent. In goose, the payload executes during `goose review`, before the model is ever contacted.

One detail shapes the threat model: delivery. Cloning a hostile URL does nothing — git never carries the malicious config over clone, fetch, or pull. The repository must arrive as files with its .git directory intact: a shared .zip, a shared drive, a sync folder, a USB stick. Every proof of concept in Manifold's research used a .zip. That is exactly how projects move between contractors, consultants, and clients.

What the attacker gets is arbitrary code execution as the developer — outside the agent's sandbox, with no approval prompt and nothing on screen. That means SSH keys, cloud credentials in the environment, tokens in shell config, every repository on disk, and a foothold on the machine, per Manifold's writeup.

Who is exposed, version by version

Status as of September 2, per Manifold Security and The Hacker News:

**Claude Code.** The core.fsmonitor path, confirmed on 2.1.193, was fixed by 2.1.196 after a June 26 report that Anthropic closed as a duplicate of a same-day filing. A second path, reached through `claude ultrareview` and turning on a different git configuration key that Manifold has deliberately not named, was still live on 2.1.252 on September 1, against a then-current release of 2.1.258. No source indicates a later release closed it, and Anthropic has published no advisory covering either finding. Claude Code ships over 77 million npm downloads a month, per the npm figures Manifold cites.

**OpenAI Codex.** Codex CLI 0.102.0 through 0.130.0 were affected and fixed in 0.131.0; Codex Desktop builds were patched in the 26.519.x line. OpenAI's CVE record for CVE-2026-19592 states the helper "runs outside Codex's command sandbox and without a user-approval prompt, allowing attacker-controlled code to run with the user's privileges." The current CLI release is 0.152.1 as of September 2, so installations pinned below 0.131.0 remain exposed.

**goose.** Reported July 13, fixed in 1.44.0. GitHub assigned CVE-2026-72718 a CVSS 4.0 base score of 7.0 — the only published score among the findings. The advisory is blunt: running goose review inside a malicious repo "runs attacker code — no submitted prompt, no model call, no tool approval, no trust prompt."

**Cursor.** Affected and patched, after Manifold's July 8 report was closed as a duplicate of an earlier filing.

**Hermes Agent.** Confirmed on 0.18.2 and again on 0.21.0 on September 1; still unpatched. Manifold says six contact attempts across five channels left the private advisory untriaged; CVE-2026-71963 was assigned by VulnCheck, an independent CVE numbering authority, because the vendor did not. Hermes is the same agent an operator ran unattended in an intrusion against a Thai government network in July, as The Hacker News reported at the time.

**Qwen Code.** Reported July 7 to Alibaba's security response centre and accepted; re-confirmed unpatched on 0.22.3 on September 1, which remained the latest npm release as of September 2.

**Grok Build.** Confirmed on 0.2.93 and again on 1.0.13 on September 1; still unpatched. xAI closed an earlier report of the same class as "informative" and Manifold's July 14 report as a duplicate of it.

The scale, per Manifold: the five open-source projects named in the writeup carry close to half a million GitHub stars combined — Hermes 237,000, Claude Code 143,000, goose 54,000, Qwen Code 27,000, Grok Build 26,000.

A regression-prone pattern, not a one-off

This is not the first time this exact sink has surfaced. Sonar reported the same class in April, noting that Anthropic had already moved Claude Code's startup sequence once to close it: version 2.0.34, shipped November 5, 2025, stopped running git status before the user approved the trust dialog — but the behavior was present again by 2.1.193, shipped June 25, 2026, per The Hacker News. The same trust-dialog bypass predates AI agents entirely: Sonar identified it in Visual Studio Code before 1.63.1 (CVE-2021-43891) and in JetBrains IDEs before 2021.3.1 (CVE-2022-24346). Anthropic's own June advisory for CVE-2026-55607 covers fsmonitor execution during worktree operations. Five of Manifold's eight reports came back as duplicates of findings other researchers had already filed independently — one on the same day. As Manifold put it, this is being found from more than one direction.

Two facts bound the current risk. First, no source reports exploitation of any of these findings, and none of the CVEs appeared in CISA's Known Exploited Vulnerabilities catalog as of September 2 (version 2026.09.01, 1,687 entries), per The Hacker News. Second, exploitation requires the repo-as-files delivery path — an ordinary clone is safe.

The harder problem is that existing controls do not see this layer. EDR observes familiar developer tooling doing familiar things; the gateway sees authenticated traffic it already allows; the agent's own permission model never sees the subprocess, because it is the agent's startup code that spawned it, Manifold notes. And the pattern generalizes beyond repositories: skills, MCP servers, and plugins also arrive as files, carry their own configuration, and get trusted on arrival. The artifact changes; the pattern does not.

What to do this week

1. **Inventory agent versions.** As of September 2: Claude Code at 2.1.196 or later closes the core.fsmonitor path — but the ultrareview path remained live on 2.1.252, so treat third-party directories as off-limits until Anthropic confirms a fix. Codex CLI at 0.131.0 or later (current release: 0.152.1). goose at 1.44.0 or later. Hermes Agent, Qwen Code, and Grok Build have no published fix — assume any third-party directory opened with them is executable content.

2. **Audit repositories that arrived as files.** Inspect .git/config before opening any received directory with an agent, looking for core.fsmonitor, core.hooksPath, and attr.tree alongside clean or process filters. Run `git config --get core.fsmonitor` inside any repository that did not arrive by clone.

3. **Disable the setting globally.** `git config --global core.fsmonitor false` removes the sink on machines that do not need the large-repo performance optimization. Audit first with `git config --global --list | grep fsmonitor`.

4. **Change handling policy.** Prefer cloning from source over opening shared archives, drives, and sync folders. If a zip must move a project, inspection happens before any agent opens it — make that a written rule, not a habit.

5. **If you ship an internal agent or harness:** sanitize the git configuration on background calls, the fix Manifold recommends — for example, `git -c core.fsmonitor=false status`. If a vendor sells you an agent, ask where their product does this. An unanswered question is an answer.

GitSpawn's lesson is not that coding agents are unsafe to use. It is that agents execute whatever their environment hands them, with the developer's privileges, before the first prompt — and the industry's review process has been aimed at the model, not the plumbing. Fix the plumbing this week; four of the eight paths are still open.