A newly disclosed vulnerability class, named GitSpawn, reveals a serious weakness in AI coding agents that automatically execute Git commands to understand a developer’s project better.
Researchers at Manifold Security discovered that several tools, including Claude Code, OpenAI Codex, Cursor, Grok Build, Goose, Hermes Agent, and Qwen Code, might inadvertently run commands controlled by an attacker during standard context collection, based on a repository’s Git configuration.
This issue is particularly troubling as vulnerable agents can invoke commands such as `git status` or `git diff` immediately after a project is opened.
In some cases, this Git activity occurs before the user has a chance to enter a prompt, approve a workspace-trust dialog, or authenticate with the service.
If a malicious repository is delivered intact with its .git directory, its configuration can cause Git to execute a command on the developer’s host system with the logged-in user’s privileges.
The primary execution path identified by researchers involves Git’s `core.fsmonitor` configuration. This legitimate setting aims to enhance performance in large repositories by allowing Git to call an external helper to determine which files have changed.
However, Git reads the `core.fsmonitor` value from the local repository configuration. When an AI agent runs commands to refresh Git’s index, such as `git status` and `git diff`, Git may inadvertently execute the configured helper command.
If the agent does not neutralize repository-controlled configurations beforehand, the repository can effectively dictate which command Git executes.
Unlike a traditional malicious Git clone, the GitSpawn attack necessitates that the victim receives a project directory containing the .git folder. Researchers noted that simply cloning, fetching, or pulling a malicious repository does not transfer the harmful configuration to the victim’s environment.
Claude Code – core.fsmonitor
Instead, likely delivery methods include ZIP archives, shared drives, synchronization folders, removable media, and project directories that are exchanged among consultants, developers, or organizations. The research team used ZIP-based delivery in their proof-of-concept demonstrations.
The potential impact is severe because the spawned process operates outside the AI agent’s usual sandbox and approval workflow. An attacker could gain access to SSH keys, cloud credentials, API tokens, shell configuration files, source code, and other repositories connected to the affected developer account.
Claude Code – ultrareview
Because the command runs through the agent’s background Git subprocess, there may be no visible warning, approval request, or interaction indicating that code has been executed.
Manifold Security documented eight findings across seven coding agents. Claude Code’s `core.fsmonitor` issue was confirmed in version 2.1.193 and reportedly fixed in version 2.1.196.
OpenAI Codex and Cursor were also affected, but researchers stated that both products have since been patched following reports from other researchers. Goose resolved its GitSpawn vulnerability in version 1.44.0, following CVE-2026-72718, which was rated 7.0 in severity.
However, as of September 1, several products remain exposed. Hermes Agent, tracked as CVE-2026-71963, was confirmed vulnerable in version 0.21.0.
Qwen Code continued to be affected in version 0.22.3, and Grok Build remained vulnerable in version 1.0.13. Researchers also reported a separate, unpatched issue in Claude Code’s ultrareview path, which utilizes a different Git configuration execution sink rather than `core.fsmonitor`.
These findings underscore a broader security concern for automated developer tools: the processing of automated context gathering can lead to the execution of untrusted code.
Vendors should invoke Git with repository configurations disabled or explicitly sanitized, particularly before establishing trust prompts or sandbox boundaries.
Developers should consider archived repositories containing .git directories as potentially unsafe and should update affected coding agents as patches become available. The comprehensive technical research is available from Manifold Security.
Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…