GitSpawn Flaw Lets Malicious Git Configs Hijack Claude, Codex, Cursor, and Other Coding Agents

Manifold Security disclosed GitSpawn, a vulnerability class in which AI coding agents that gather repository context with background Git commands can execute attacker-supplied programs named in a repository’s own .git/config. Coverage on The Hacker News and a Cloud Security Alliance research note describe eight findings across seven agents, with several still exploitable after retesting. Public write-ups place the disclosure window around September 1–2, 2026, with the CSA note dated September 4, 2026.

The sink is ordinary Git behavior. Settings such as core.fsmonitor name a helper that Git runs when it refreshes its index during commands like git status or git diff. Because many CLI coding agents shell out to Git at startup — sometimes before a workspace-trust prompt or authentication — a hostile config can run as the developer, outside the agent sandbox, with no tool-call approval UI.

Delivery path and affected agents

Ordinary git clone does not import a remote’s local config. The attack requires the repository to arrive as files with .git intact — for example a shared zip, synced drive, or USB stick. Manifold’s write-up and CSA summary name Claude Code, OpenAI Codex, Cursor, Block’s Goose, Alibaba’s Qwen Code, xAI’s Grok Build, and Hermes Agent among the tested products.

As of Manifold’s September 1 retest and the September 1–2 public disclosure window, Claude Code’s primary core.fsmonitor path, Codex, Cursor, and Goose had received fixes for at least one variant. CSA’s note lists Goose’s fix in 1.44.0 with CVE-2026-72718, and OpenAI CVEs CVE-2026-19592 (Codex CLI) and CVE-2026-19593 (Codex Desktop). Remaining unpatched at publication, per Manifold and CSA, included Qwen Code, Grok Build, Hermes Agent (CVE-2026-71963 assigned by VulnCheck), and a second Claude Code path reached through claude ultrareview that uses a different withheld Git config key.

What defenders should do now

Immediate guidance from the disclosure is operational as much as vendor-facing. Teams should inventory coding-agent versions and update Claude Code, Cursor, Codex, and Goose to fixed builds, noting Claude Code’s second path may still be open. Before opening a repository that arrived as a file transfer rather than a fresh clone, inspect .git/config for unexpected program-valued settings, including core.fsmonitor. A global git config --global core.fsmonitor false is not a reliable interim fix, because repository-local config overrides global settings. Manifold’s guidance is to inspect transferred repos’ .git/config and for vendors and tooling to invoke Git with an explicit override such as git -c core.fsmonitor=false …. For still-unpatched agents, CSA recommends avoiding unverified archives or isolating those tools from production credentials until vendor fixes land.

Manifold’s research frames the issue as widespread plumbing rather than a single vendor bug: automatic context gathering treats repository-local Git config as safe, while Git itself can turn that config into host command execution. Primary sources for this brief are Manifold Security’s GitSpawn post, The Hacker News coverage in the September 1–2, 2026 window, and the CSA research note dated September 4, 2026.