A new class of AI coding agent security bug has a surprisingly ordinary entry point: Git itself.
Manifold Security calls the issue GitSpawn. The core problem is not that an agent misunderstood a prompt. It is that an agent ran a normal Git command while gathering repository context, and Git honored an executable setting stored inside the repository's own .git/config.
That turns “open this project” into a potentially privileged operation.
The mechanism: context gathering becomes code execution
Many CLI coding agents inspect a repository as soon as they start. They may run commands such as:
git status --porcelain=2 --branch
git diff --name-only HEAD
These are ordinary commands, but Git may refresh its index before returning the result. Git's core.fsmonitor setting can name a helper program to run during that refresh. The setting is read from the repository-local .git/config file.
A project delivered as a complete directory, ZIP archive, shared-drive folder, USB copy, or sync-folder snapshot can therefore carry a Git configuration that names a program. When the agent runs Git, the helper can execute with the developer's operating-system privileges.
The important boundary is timing. Manifold reports that, in the affected flows it tested, execution happened during background context gathering, before a workspace-trust prompt, before an approval prompt, and in some cases before authentication. The model does not need to generate a dangerous command, and the user may not see a prompt.
What the disclosure actually found
This is a researcher disclosure, not an independent prevalence study. Manifold reports eight findings across seven agents and says four remained unpatched at publication. Its September 1 update says OpenAI Codex and Cursor were also affected and had since been patched.
The report lists these statuses at publication:
- Claude Code's core.fsmonitor path: fixed in 2.1.196.
- Goose: fixed in 1.44.0, with CVE-2026-72718.
- OpenAI Codex and Cursor: patched, according to the update.
- Hermes Agent: still unpatched in the tested 0.21.0 release, with CVE-2026-71963.
- Qwen Code: still unpatched in the tested 0.22.3 release.
- Grok Build: still unpatched in the tested 1.0.13 release.
- Claude Code's separate ultrareview path: reported as still unpatched in the tested 2.1.252 release.
Treat those version claims as time-sensitive. Check the vendor's current release notes and advisory before deciding whether a version is safe.
Why a sandbox may not save you
A sandbox around the model's tool calls is not automatically a sandbox around every subprocess the agent launches. In this case, the dangerous process is Git, which the agent invokes for its own bookkeeping. If the product does not sanitize repository configuration for that subprocess, the command can run outside the model-facing approval path.
That is a useful design lesson for agent harnesses: permission checks must cover the complete execution graph, including startup probes, Git helpers, formatters, language servers, hooks, plugins, MCP servers, and other “read-only” context tools.
A safer intake workflow
Before opening an unfamiliar directory with an AI coding agent:
- Prefer cloning from a trusted remote over accepting a complete project folder. A normal clone does not carry the remote repository's original .git/config.
-
Inspect the local Git configuration without launching the agent:
sed -n '1,200p' .git/config
Treat any Git setting that names an executable as untrusted code. The reported proof of concept uses core.fsmonitor, but the broader rule is more useful than memorizing one key.
Use a disposable VM or tightly scoped container for untrusted project directories. Keep SSH keys, cloud credentials, and production tokens out of that environment.
Update the agent and verify the exact fixed version. “The agent has an approval prompt” is not enough if startup context gathering happens before the prompt.
For agent authors, the mitigation is equally concrete: pass safe Git configuration explicitly for background calls, for example git -c core.fsmonitor=false status, and review every subprocess used before trust and authorization decisions.
The broader takeaway
AI coding agent security is partly a model problem, but it is also a plumbing problem. The model can be perfectly aligned while the harness exposes a trusted developer process to untrusted repository metadata.
The right review question is not only “What commands can the agent propose?” It is also “What runs automatically before the user has approved anything?” Audit that startup path, test it with hostile-but-non-destructive fixtures, and make execution, approval, and sandbox boundaries line up.
Sources and evidence provenance
- Manifold Security: Coding Agents Hijacked by a Git Call — primary researcher disclosure; version and patch status are the researcher's reported findings.
- AI/TLDR summary of GitSpawn — secondary tracker summary, cross-checked against the primary report.
- Git documentation for core.fsmonitor — upstream reference for the Git configuration behavior.
This article intentionally avoids reproducing a weaponized repository or payload. The goal is to make the boundary visible and give developers a safer intake and testing workflow.
Top comments (0)