The security service provider Manifold Security reveals on September 1, 2026, eight vulnerabilities named GitSpawn that affect seven common AI coding agents. A prepared Git directory is sufficient for the first automatic Git command to run program code with the full rights of the developer – without any confirmation. Four of the eight gaps have now been closed, while four remain open according to the researchers.
GitSpawn uses a harmless Git configuration as an entry point
AI coding agents like Claude Code, OpenAI Codex, or Cursor automatically call Git commands like git status or git diff at startup to capture branches and changed files. In doing so, Git reads the core.fsmonitor setting from the .git/config file – a useful performance feature that names a utility for faster detection of changed files. Because a repository can bring this setting itself, a prepared Git directory is enough to enter any command there.
If the agent updates the Git index in the background, Git executes this command – outside the agent’s sandbox and without any confirmation prompt. The trick only works if the folder is transferred along with the real .git directory, for example via a ZIP archive, a USB stick, or a synchronized folder. A regular clone with git clone, on the other hand, automatically removes the risky configuration.
With multiple agents, the malicious code runs even before any security dialog: with Claude Code and Hermes Agent already before the prompt asking if the workspace is trusted, with Qwen Code even before logging in, and with Grok Build already at the first keystroke in the editor.
Four manufacturers patch, three leave the gap open
According to Manifold Security, Anthropic has closed the reported variant in Claude Code, OpenAI in Codex, Anysphere in Cursor, and Block in its open-source agent Goose. For Goose, GitHub assigned a CVSS score of 7.0 with CVE-2026-72718, fixed in version 1.44.0. OpenAI confirms in its own correction to the Codex source code that the utility runs outside the command sandbox and without a release dialog, and can read, modify, or delete files.
According to Manifold Security, Qwen Code from Alibaba, Grok Build from xAI, and Hermes Agent from Nous Research remain open; for the latter, there is an identifier with CVE-2026-71963, but no patch. Alibaba’s security team has accepted the finding but has not yet delivered it. xAI classified the report as a duplicate of an older, informational report, and Nous Research has not responded to six contact attempts through five channels.
Grok Build had already attracted attention before: The agent uploaded complete repositories to corporate-owned servers. With GitSpawn, a second independently reported vulnerability is now added.
Immediate measures replace the missing patch
If the attack succeeds, a stranger receives the same rights as the logged-in developer, according to Manifold Security: access to SSH keys, cloud credentials stored in the environment, tokens from shell configuration files, and all locally stored repositories. The first reports to the manufacturers date back to June 26, 2026, with most corrections following in July, and the public disclosure only on September 1, 2026.
Anyone using one of the affected tools can check the configuration of each received repository before opening it: entries related to core.fsmonitor, core.hooksPath, or attr.tree in the .git/config file are suspicious. Manifold Security additionally recommends disabling the function system-wide, via git config —global core.fsmonitor false.
From the manufacturers’ side, the researchers suggest securing internal Git calls with the additional option -c core.fsmonitor=false, as Codex now does after the patch. A publicly documented, already ongoing exploitation of the vulnerability outside of Manifold Security’s test environment is not yet known.
It will be crucial whether Qwen Code, Grok Build, and Hermes Agent follow suit before the technique is used beyond test environments. GitSpawn thus joins a growing list of similar cases involving AI coding agents, where the actual vulnerability is not a single manufacturer’s fault but a recurring architectural pattern: automated background commands that run without verified inputs.
