{"id":79469,"date":"2026-09-02T11:49:07","date_gmt":"2026-09-02T15:49:07","guid":{"rendered":"https:\/\/overcentral.com\/en\/?p=79469"},"modified":"2026-09-02T11:49:07","modified_gmt":"2026-09-02T15:49:07","slug":"gitspawn-vulnerability-ai-coding-agents-79469","status":"publish","type":"post","link":"https:\/\/overcentral.com\/en\/gitspawn-vulnerability-ai-coding-agents-79469\/","title":{"rendered":"Malicious .git Configs Hijack Claude, Codex, Cursor Run Attacker Code"},"content":{"rendered":"

Manifold Security has disclosed eight security flaws<\/a> across seven command-line AI coding agents<\/a> in which a repository’s own Git configuration names a command that the agent runs on the developer’s machine, four of them still unpatched at publication. The command executes as the user, outside the agent’s sandbox and without an approval prompt, and exploitation requires the repository to arrive as files with its .git<\/strong> directory intact, which a shared archive, a shared drive, a sync folder, or a USB stick preserves, whereas an ordinary clone does not. Fixes have shipped for goose, Claude Code, and Cursor, while Hermes Agent, Qwen Code, Grok Build, and a second path in Claude Code were still executing repository-supplied commands when Manifold retested them on September 1. OpenAI published three CVEs of its own the same day covering the identical class in Codex, credited to three unrelated research groups.<\/p>\n

How a Git Performance Setting Becomes an Attack Vector<\/h2>\n

At the center of these vulnerabilities is core.fsmonitor<\/strong>, a Git performance setting whose value is a command that Git runs to identify changed files. Git reads it from the repository’s own .git\/config<\/strong>. Any operation that refreshes the index, including git status<\/strong> and git diff<\/strong>, executes that command. The AI coding agents call those commands in the background to determine which branch they are on and which files have changed, leaving the repository’s configuration untouched. Exploitation is straightforward: an attacker places a malicious .git\/config<\/strong> inside a repository that arrives as a tarball, Zip archive, shared folder, or USB drive. When the agent opens the repository and triggers a Git status call, the attacker’s command runs with the user’s privileges.<\/p>\n

Manifold, which published the findings as GitSpawn, wrote up five of the eight in detail and said it found the pattern in more agents than it names. “The vulnerability is not in the model, or in anything new. It is in the ordinary plumbing underneath, the subprocess an agent spawns at session startup to work out where it is,” the firm said. On Claude Code and Hermes Agent, the payload fires before the workspace-trust prompt is accepted; on Qwen Code, before the user has authenticated; and on Grok Build, on the first keystroke.<\/p>\n

What Is core.fsmonitor and Why Does It Enable Code Execution?<\/h2>\n

Core.fsmonitor is a Git configuration option that allows a repository to specify an external program to monitor the filesystem for changes. When Git runs an operation that needs to update its index, it executes the command defined in core.fsmonitor<\/strong>. Because the value is read directly from the repository’s own Git configuration, an attacker can embed any command there. The AI coding agents, in their normal operation, invoke Git commands such as git status<\/strong> or git diff<\/strong> without stripping this configuration. The command then executes on the developer’s machine, outside any sandbox, with the full privileges of the user running the agent.<\/p>\n

OpenAI’s advisory for Codex under CVE-2026-19592<\/strong> states: “The helper runs outside Codex’s command sandbox and without a user-approval prompt, allowing attacker-controlled code to run with the user’s privileges. The code can read, change, or delete the user’s files and access other resources available to the user’s account.”<\/p>\n

Affected AI Coding Agents and Patch Status<\/h2>\n

Manifold Security tested each agent and confirmed the vulnerability. The following versions are affected, with fixes applied only to some as of September 1, 2026:<\/p>\n