GitSpawn: a repository's own git config could run code when AI coding agents gathered context

Research · Claude Code, Goose, Hermes, Qwen Code, Grok Build, Codex, Cursor · HIGH

Incident dateNot stated

DisclosedSep 1, 2026 (Manifold Security). Reported privately Jun 26 to Jul 20, 2026.

Added hereOct 14, 8:55 PM ET

Last verifiedOct 14, 2026

Summary

Manifold Security's GitSpawn research, published Sep 1, 2026, found that several AI coding agents run git in the background to gather context, sometimes before the trust prompt or login. If a project arrives as files with its .git folder included (a zip, shared drive or USB stick, not a normal clone), a setting such as core.fsmonitor in .git/config can make that git call run any command on the host, outside the agent's sandbox and without an approval prompt. Manifold reported eight findings across seven agents and said four were unpatched when it published. Statuses below are as of Sep 1, 2026 unless a later source says otherwise.

Severity

HIGH Code execution as the developer, outside the sandbox, with no prompt. Delivery is narrow: cloning, fetching or pulling does not carry the hostile config.

Timeline

Jun 26, 2026
Manifold reports the Claude Code core.fsmonitor path. It is fixed by 2.1.196.
Jul 13, 2026
Manifold reports goose review. Fixed in Goose 1.44.0 as CVE-2026-72718.
Sep 1, 2026
Manifold publishes. As of that date it lists as unpatched: Claude Code ultrareview (confirmed on 2.1.252), Hermes (0.21.0), Qwen Code (0.22.3) and Grok Build (1.0.13). Codex and Cursor were duplicates of earlier reports and patched.
Sep 3, 2026
CVE-2026-71963 for Hermes Agent 0.18.2 to 0.21.0 is published by VulnCheck and lists a fix in commit f6234d0.

How it happened

Commands like git status and git diff refresh the index, and during that refresh git runs whatever helper the repository's own .git/config names in core.fsmonitor. The agents called git without stripping the repository's config, so the repository decided what ran. Manifold's per-agent findings: Claude Code core.fsmonitor fixed by 2.1.196; Claude Code ultrareview (a different git setting Manifold left unnamed) unpatched on 2.1.252 as of Sep 1; Goose fixed in 1.44.0 (CVE-2026-72718); Hermes unpatched on 0.21.0 as of Sep 1, since fixed in commit f6234d0 per the CVE-2026-71963 record; Qwen Code accepted by Alibaba's security team, unpatched on 0.22.3 as of Sep 1; Grok Build, an earlier report of the same class was closed as informative and Manifold's as a duplicate, unpatched on 1.0.13 as of Sep 1. We have not retested any agent; check each vendor's current release notes.

How to check your app

Before opening a project you received as a zip or folder copy with an AI agent, read its .git/config. Any setting that names a program (core.fsmonitor and similar) can run it.
Prefer cloning from a remote over opening a copied folder: git clone does not carry the sender's .git/config.
Keep each agent up to date and check its release notes for this fix.

Sources

Corrections and updates

None. Re-checked against every source on Oct 14, 2026.