GitSpawn: A Received Repo's .git/config Runs Code Outside Coding Agents' Sandboxes

Never point a coding agent at a repository that arrived as files: an archive, a shared drive, a sync folder, a USB stick. Clone it from the remote instead. Per The Hacker News, exploitation "requires the repository to arrive as files with its .git directory intact", and "an ordinary clone does not" preserve it. That one habit closes every path below, including the four that had no fix at Manifold's 1 September retest: Claude Code's claude ultrareview path, Hermes Agent, Qwen Code and Grok Build.

Affected: Claude Code, OpenAI Codex, Cursor and Grok Build CLI, plus goose, Hermes Agent and Qwen Code, which are not in our directory.

What happened

Manifold Security published GitSpawn on 1 September 2026, and The Hacker News covered it on 2 September.

Git's core.fsmonitor setting names a command that Git runs to find changed files, and Git reads it from the repository's own .git/config. As The Hacker News puts it, "any operation that refreshes the index, including git status and git diff, executes that command." Coding agents run those commands in the background to understand the workspace.

OpenAI's CVE record for Codex, CVE-2026-19592, describes the result: "The helper runs outside Codex's command sandbox and without a user-approval prompt, allowing attacker-controlled code to run with the user's privileges."

Status, dated to the source that supports it

We re-read both sources on 23 September: Manifold's post carries one update, dated 1 September, and The Hacker News article has no update after 2 September. Newer releases have shipped since (Claude Code 2.1.280 and Qwen Code 0.24.4 were the latest releases on 23 September), and we have not confirmed whether they close these paths. Treat the four statuses as confirmed only to 1 September.

On advisories: goose's GitHub advisory carries CVE-2026-72718 with a CVSS 4.0 base score of 7.0, "the only score any of these findings carries". Hermes Agent has CVE-2026-71963, assigned by VulnCheck, "an independent CVE Numbering Authority, not the vendor", and Manifold says its private GHSA advisory "was never triaged". The Hacker News found that Anthropic's published advisory record "covers neither of the Claude Code findings." No source reports exploitation: CISA's Known Exploited Vulnerabilities catalog (version 2026.09.01) lists none of these CVEs.

Why it matters

Timing removes the usual safety net. On Claude Code and Hermes Agent the payload fires before the workspace-trust prompt is accepted, on Qwen Code before the user has authenticated, and on Grok Build on the first keystroke.

The second Claude Code path "turns on a different Git configuration key that Manifold has withheld", and claude ultrareview "runs the repository's command on start-up, before the review it was asked for begins." Because it uses a different key, disabling core.fsmonitor is not documented to close it.

It is also a regression for Claude Code. Version 2.0.34 (5 November 2025) mitigated the same class of bug by no longer running git status before trust approval, but Manifold reports that startup behavior present again in 2.1.193, shipped on 25 June 2026.

What changes for you

• Clone from the remote instead of opening a received copy with its .git directory intact.
• Inspect .git/config in any received directory for core.fsmonitor, core.hooksPath and attribute filters, and run git config --get core.fsmonitor inside it.
• Set git config --global core.fsmonitor false.
• Update Codex, goose and Claude Code to at least the fixed versions above.
• Do not run claude ultrareview in a directory you did not clone yourself.
• Treat Hermes Agent, Qwen Code and Grok Build as unpatched until their maintainers confirm a fix; none had one at Manifold's 1 September retest.

Where our ratings stand

Claude Code stays conditional, OpenAI Codex recommended, Cursor conditional and Grok Build CLI caution. None moves on this finding alone. The difference is in the response: Codex and goose shipped fixes with CVEs, Hermes Agent's CVE came from a third party, and, as of 2 September, Anthropic's published advisory record covered neither Claude Code path.

FAQ

Does setting core.fsmonitor to false protect me everywhere? No. It covers the core.fsmonitor paths, but Claude Code's claude ultrareview path uses a different key that Manifold has not disclosed.

Is a normal git clone safe? Per The Hacker News, an ordinary clone does not preserve the attacker's .git/config, so the attack needs a repository that arrived as files.

Is this being exploited? No source reports exploitation, and none of the CVEs was in CISA's Known Exploited Vulnerabilities catalog as of version 2026.09.01.