GitSpawn: The .git Config Trick That Hijacks AI Coding Agents

Security researchers at Manifold Security published a disclosure last week they've dubbed "GitSpawn" — eight vulnerabilities across seven major AI coding agents, all rooted in the same blind spot: the tools execute git context-gathering commands before they show a workspace-trust prompt, and a maliciously crafted repository can steer exactly what those git calls run. Affected tools include Claude Code (CVE-2026-55607), OpenAI Codex (CVE-2026-19592), Cursor (CVE-2026-48124), and Grok Build, among others. Four products remain unpatched as of publication on September 1–2, 2026.

How a Git Performance Setting Becomes a Loaded Gun

Git has a configuration key called core.fsmonitor. It's a performance optimization: you point it at a helper daemon that reports which files changed, so Git doesn't have to walk the whole working tree. The value is just a command name, and Git runs it when it refreshes the index.

AI coding agents — Claude Code, Codex, Cursor, and their kin — run git status and git diff constantly in the background to track edits and build context for completions. Those git calls refresh the index. The index refresh reads .git/config. And .git/config sits inside the repository directory, controlled entirely by whoever put that directory on your machine.

An attacker who plants [core] fsmonitor = /path/to/payload in a repository's .git/config gets their command executed with the developer's full OS privileges the moment the agent does its first background git call — before Claude Code shows a workspace-trust dialog, before Codex requests confirmation, before Grok Build accepts a single keystroke. The execution happens entirely outside the agent's command sandbox, with no approval prompt.

The Catch: Normal git clone Is Not the Vector

When you git clone a repository, Git generates a fresh .git/config from the remote's advertised configuration; the malicious fsmonitor entry doesn't survive the transit. The attack requires a directory that arrives with its .git folder already intact — a ZIP archive, a shared Google Drive or Dropbox folder, a USB stick, a network share, a container image unpacked as a filesystem layer, an scp'd tarball. In short: anything that moves a directory rather than cloning it.

That's a realistic threat surface. Shared project archives, vendor-supplied starter templates, "here's the repo" ZIP files from contractors, Docker images derived from external sources, and even corporate Confluence attachments all fit the pattern. Manifold notes that five independent researchers reported variations of this technique between December 2025 and July 2026, suggesting the technique has been circulating in offensive security circles for most of the year.

What's Patched, What Isn't

As of Manifold's September 1 publication:

• Claude Code (CVE-2026-55607): The core.fsmonitor execution path was fixed in v2.1.196, patched June 29, 2026 — three days after Manifold's report. However, a second execution path introduced in v2.1.210 via the ultrareview workflow carries the same flaw and remains unpatched through at least v2.1.252.
• OpenAI Codex CLI (CVE-2026-19592): Patched in v0.131.0. Codex Desktop patched in v26.519.22136 (macOS) and v26.519.21041 (Windows).
• Cursor (CVE-2026-48124): Patched in v3.0.0.
• Goose (CVE-2026-72718, CVSS 7.0): Patched in v1.44.0.
• Grok Build: Unpatched through v1.0.13. xAI initially closed an earlier report as "informative" in July before Manifold filed a second report in mid-July; no fix as of publication.
• Qwen Code: Unpatched through v0.22.3. Alibaba accepted the report in July; no confirmed fix date.
• Hermes Agent (CVE-2026-71963): Unpatched through v0.21.0.

None of these CVEs appear in CISA's Known Exploited Vulnerabilities catalog, and Manifold reports no confirmed exploitation in the wild as of their write-up. Given that a working exploit requires nothing more exotic than a text editor and a ZIP utility, that's a window that could close fast once the research spreads.

What an Attacker Can Actually Do

Code execution with developer-level OS privileges is the entry point, not the destination. On a typical engineering workstation that means reading ~/.ssh private keys, AWS or GCP credential files, .env secrets in neighboring project directories, browser session cookies, and any stored passwords that don't require re-authentication. From there, lateral movement to cloud infrastructure, CI/CD pipelines, package registries, or production deployment keys is straightforward — and quiet, since the agent's own sandbox logging never sees the payload fire.

The vector is also effective against shared developer environments. A malicious ZIP distributed inside a team's shared drive affects everyone who opens it with a vulnerable agent, not just the recipient.

What Developers and Businesses Should Do Now

• Update your AI coding agent. Claude Code ≥ 2.1.196 addresses the fsmonitor path (the ultrareview path awaits a follow-up fix — watch for it). Codex CLI ≥ 0.131.0, Cursor ≥ 3.0.0, Goose ≥ 1.44.0.
• Audit external project archives before opening them with any AI agent. Run grep -r fsmonitor .git/config before pointing an agent at a directory you didn't personally clone. Any [core] entry naming a command should raise an immediate red flag.
• Prefer git clone over ZIP downloads. Cloning regenerates .git/config from the remote's advertised settings; compressed archives preserve whatever the sender put there.
• Structurally isolate dev machines from production credentials. GitSpawn delivers OS-level access — if your development workstation holds direct SSH keys, deployment tokens, or IAM credentials for live infrastructure, a single poisoned archive becomes a production breach. Developer machines should require a separate authentication step to reach production, not a direct key.
• Treat third-party code archives with vendor-level scrutiny. A ZIP from a new contractor is exactly the threat model GitSpawn was designed to exploit.

Grok Build, Qwen Code, and Hermes Agent users have no vendor-supplied fix yet. The practical mitigation is the same for all: inspect .git/config before opening any external project in an AI agent, and consider adding that check as a Git alias or shell hook so it becomes automatic rather than optional.

The deeper lesson here is one we've seen repeat across supply-chain attacks for years: the trust boundary eroded first, and the tools caught up to policy later. AI coding agents are now deeply embedded in development workflows, and their need for real-time file context means they're running git plumbing in the background constantly — creating an attack surface that didn't exist when these agents were simpler chat interfaces. Keeping production credentials structurally out of reach of developer machines, and treating every external code archive like an untrusted package, is the durable answer regardless of which vendor ships the next patch.