Security researchers at Manifold Security disclosed a vulnerability class called GitSpawn in which a booby-trapped code repository silently executes attacker-chosen commands the moment an AI coding assistant opens it, before any approval prompt appears. Eight findings across seven agents were reported — Claude Code, OpenAI Codex, Cursor, Goose, Hermes Agent, Qwen Code and Grok Build — and every agent tested was vulnerable. Four of the eight remained unpatched on the day the research went public.
Key facts
- The headline number: eight findings across seven AI coding agents, all seven vulnerable, four still unpatched at publication.
- When: retest confirmed 1 September 2026; disclosed publicly in September 2026.
- Who: Francisco Rosales, offensive security engineer at Manifold Security.
- Primary source: Manifold Security's writeup.
The mechanism is elegant and slightly horrifying, and it does not involve the model at all. Git has a setting called core.fsmonitor whose value is the path to an external program. Git runs that program to speed up checking which files have changed. Crucially, the setting can live in a repository's own .git/config file — which means the repository can carry it, and the instruction to run a given program travels with the folder.
Now add the agent. Rosales's team looked at what command-line coding agents actually do in the first moments after they start, and found that nearly all of them quietly run git commands like git status or git diff to work out what project they are in. That is sensible behaviour: the agent wants context before it does anything. But running git status inside a repository that ships a hostile core.fsmonitor executes the attacker's program. As Rosales puts it, "several git settings are command execution sinks."
The result is that the agent's safety model is bypassed rather than defeated. Coding agents are built around a permission prompt: the agent proposes a command, you approve it, it runs. GitSpawn fires underneath that entire design, during the automatic context-gathering that happens before the conversation starts. There is no command to approve because the agent never decided to run anything — git did.
The everyday analogy is a house key that also works on the alarm panel. You have been careful about who you give the key to, and the alarm is the backstop for when you are wrong. GitSpawn is the discovery that the act of putting the key in the door silently disables the alarm — so the care you took over the front door was the only protection you actually had.
Why it matters is a question of how much untrusted code developers now open with an agent attached. Cloning a stranger's repository to look at it has historically been safe, because reading code does not run it. That assumption is load-bearing across the whole open-source ecosystem, and AI agents quietly broke it by making "open a folder" mean "run several programs to see what is here." Claude Code alone exceeds 77 million monthly npm downloads, which gives a rough sense of the exposed surface.
Patch status at disclosure was mixed. Claude Code fixed the core.fsmonitor variant in v2.1.196, Goose fixed its issue in v1.44.0 under CVE-2026-72718, and Codex and Cursor shipped fixes. Still confirmed vulnerable at the 1 September retest were Hermes Agent v0.21.0 (CVE-2026-71963), Qwen Code v0.22.3, Grok Build v1.0.13, and a second variant affecting Claude Code v2.1.252.
The fix is almost comically small, which is the most damning detail in the report. Agents should sanitise the git config on their background calls — running git -c core.fsmonitor=false status instead of bare git status. One flag. No architectural rewrite. Rosales's advice to developers in the meantime is to "inspect .git/config before you open the directory with an agent."
The honest caveat: this requires a victim to open a repository they do not control with an agent, so it is not wormable and not remote. Several vendors patched promptly and coordinated disclosure worked. And the underlying git behaviour is documented, not a git bug — the agents inherited a sharp edge that has been sitting in the tool for years, which is a recurring pattern as autonomous software gets pointed at ecosystems designed for careful humans.
It fits a wider pattern Ground Truth has tracked, from the UK's NCSC warning that shadow AI inherits enterprise privileges to the general problem of sandboxing AI agents and prompt injection. GitSpawn is a reminder that not every agent security failure is a language problem — some are just the old software supply chain, newly reachable. Additional coverage from The Hacker News.
Originally published on Ground Truth, where every claim is checked against the primary source.
Top comments (0)