Your coding agent runs git before you type — and the repo picks the command

What is this?

On 1 September 2026, Manifold Security published GitSpawn: eight findings across seven command-line AI coding agents, in which a repository you were sent can name a command that the agent executes on your machine. Four were still unpatched at publication, re-confirmed against current releases. The Hacker News covered it the following day and noted that OpenAI published three advisories of its own the same day for the identical class in Codex, credited to three unrelated research groups.

The affected products are not niche. Claude Code, OpenAI Codex, Cursor CLI, goose, Qwen Code, Grok Build and Hermes Agent — close to half a million GitHub stars between the open-source projects, and over 77 million monthly npm downloads for Claude Code alone, per the npm API figure Manifold cites.

The finding is notable because nothing about it involves the model. No prompt, no injection, no jailbreak. It is the subprocess the agent spawns before it has said anything.

How it works

Every CLI coding agent gathers context when it opens a folder: which branch, which files changed, which paths are tracked. They all reach for git to do it — on some agents at startup, before the workspace-trust prompt, on one before the user has even authenticated.

The problem is what those calls inherit.

Agent starts in ./received-project
   │
   ├─ spawns:  git status --porcelain=2 --branch
   │           (or git diff --name-only HEAD — the choice doesn't matter)
   │
   ├─ git refreshes the index before answering
   │
   ├─ index refresh consults core.fsmonitor
   │           …which git reads from ./received-project/.git/config
   │
   └─ that value is a PROGRAM. Git runs it.
              → executes as the user
              → outside the agent's sandbox
              → no approval prompt, nothing on screen

core.fsmonitor is a legitimate performance setting for large repositories: rather than stat every file, git asks a helper program what changed. Documented, intended, and read from the repository’s own config file. As Cobalt put it in a red-team writeup last December, this is feature abuse, not a bug — the flexibility of git meeting the automation of a modern IDE. Manifold also confirmed a second Claude Code path, reached through a review command, that turns on a different config key of the same kind; the researchers deliberately withheld that key while it remains live.

Delivery is the constraint that makes this survivable. Cloning a hostile URL does nothing. git clone, fetch and pull do not carry a repository’s local config. The repository has to arrive as files with its .git directory already inside — a shared .zip, a sync folder, a shared drive, a USB stick. Which is exactly how colleagues pass projects around and how consultants hand work to clients.

Example prompt

A defensive prompt to hand your agent before you let it open a folder that arrived as files. It inspects the config rather than trusting it, and the hostile value is redacted — the point is the shape of the setting, not a working payload.

# Defensive check — before opening a repo you RECEIVED as files
Read ./received-project/.git/config. Do not open the folder with an agent yet.
List every key whose value is a program:
  core.fsmonitor, core.hooksPath, filter.*.clean, filter.*.process, attr.tree
For each, report the key, its value, and whether that path is executable.
Never run a value you find. A hostile entry looks like:
  [core]
      fsmonitor = [REDACTED payload path]
Then re-check with a config-stripped call:
  git -c core.fsmonitor=false status --porcelain

Note what this does not do: it never executes the value it finds, and the final call strips the repository’s own config rather than reading it. That is the same invariant the vendors are being asked to adopt in the harness itself.

Why it matters

The blast radius is the developer account, not the agent session. Attacker code executes with the user’s privileges: SSH keys, cloud credentials in the environment, tokens in the shell config, every repository on disk. The agent’s permission model never sees the call, because the agent’s own code made it.

Three structural points are worth carrying away.

The sandbox was never in the path. Considerable engineering has gone into approval prompts and tool sandboxes for what the model decides to do. This runs before the model is contacted at all. A control that only covers model-initiated actions leaves the harness’s own subprocesses unguarded.

Trust prompts fire too late. On Claude Code and Hermes Agent the payload runs before the workspace-trust prompt is accepted; on Qwen Code, before authentication; on Grok Build, on the first keystroke. A trust dialog that appears after context-gathering is decoration.

This is a known class, rediscovered. Sonar reported the same sink in April 2026, and identified the same trust-dialog bypass in Visual Studio Code and JetBrains IDEs years earlier. Anthropic moved the startup sequence in 2.0.34 (November 2025) to close it; Manifold reports the same startup behaviour present again in 2.1.193 (June 2026). Regressions are the expected outcome when the fix is a sequencing change rather than an invariant.

Five of Manifold’s eight reports came back as duplicates of findings other researchers had filed independently, one on the same day. Multiple teams are converging on this surface at once.

Defenses

If you receive a repository as files — anything that did not arrive via git clone:

• Inspect .git/config before opening the directory with an agent. Look for core.fsmonitor, core.hooksPath, and attr.tree alongside a clean or process filter — any setting whose value is a program.
• Check a suspect repository directly: git config --get core.fsmonitor.
• Audit your global config: git config --global --list | grep fsmonitor.
• Turn the setting off by default: git config --global core.fsmonitor false. You lose a performance optimisation most repositories never needed.
• Prefer cloning over unpacking. If someone sends an archive, push it to a remote and clone it, or delete .git and re-init.

If you ship an agent — the fix Manifold and OpenAI both recommend:

• Strip the repository’s config on every background call: git -c core.fsmonitor=false status. Allowlist the config keys you pass rather than denylisting the ones you know about, because core.fsmonitor is not the only execution sink.
• Move context-gathering after the workspace-trust prompt, and treat that ordering as a tested invariant, not a one-off change — this exact sequencing has regressed once already.
• Run background subprocesses inside the same sandbox as model-initiated tool calls. The current split, where the harness’s own calls escape the boundary, is the root cause.

Organisationally: pin and track agent versions (an installation left below the fixed release stays exposed regardless of what the vendor shipped), and treat “opened a received folder with an agent” as an execution event in your threat model, not a read.

Status

Agent	Reported	Status at Manifold’s 1 Sep retest	Reference
goose	13 Jul 2026	Patched in 1.44.0	CVE-2026-72718, CVSS 4.0 base 7.0
Claude Code (core.fsmonitor)	26 Jun 2026	Patched by 2.1.196	No vendor advisory published
Claude Code (review path)	15 Jul 2026	Unpatched — confirmed on 2.1.252	Config key withheld by researchers
OpenAI Codex	20 Jul 2026	Patched — CLI 0.131.0, Desktop 26.519.x	CVE-2026-19592 and two others
Cursor CLI	8 Jul 2026	Patched	Duplicate of an earlier report
Qwen Code	7 Jul 2026	Unpatched — confirmed on 0.22.3	Accepted by Alibaba SRC
Grok Build	14 Jul 2026	Unpatched — confirmed on 1.0.13	Earlier report closed as informative
Hermes Agent	20 Jul 2026	Unpatched — confirmed on 0.21.0	CVE-2026-71963, assigned by VulnCheck
Exploitation	—	No source reports exploitation in the wild; none listed in CISA KEV as of 2 Sep 2026	—

Versions, dates and disclosure outcomes above are as reported by Manifold Security and The Hacker News in the linked publications. Manifold states it found the same pattern in agents it does not name, and withheld both a ready-to-use repository and the second Claude Code config key. Check your own installed version against the fixed release rather than assuming a vendor patch reached you.