A repository that runs code when you open it
Manifold Security has disclosed a class of vulnerabilities it calls GitSpawn, in which a repository’s own configuration file executes a command on the developer’s machine the moment an AI coding agent is pointed at it. The firm documented eight findings across seven agents: Claude Code, OpenAI’s Codex CLI, Cursor, Goose, Grok Build, Hermes Agent and Qwen Code. Four were still unpatched when Manifold retested on 1 September.
Nothing in the attack involves the model. Command-line agents run ordinary git commands at startup — git status, git diff — to work out which branch they are on and what has changed. Git has a performance setting called core.fsmonitor that names a helper program git runs whenever it refreshes its index, and that setting is stored in the repository’s own .git/config. A repository delivered with its .git directory intact therefore carries an instruction the agent triggers by itself.
“The vulnerability is not in the model, or in anything new,” Manifold wrote. “It is in the ordinary plumbing underneath, the subprocess an agent spawns at session startup to work out where it is.”
It fires before the trust prompt
The command runs as the logged-in user, outside whatever sandbox the agent normally uses, and with no approval dialog. Manifold reports that execution happens before workspace-trust approval in Claude Code and Hermes Agent, before the user has authenticated in Qwen Code, and on the first keystroke in Grok Build. Anything the developer can reach — SSH keys, cloud credentials — is in reach of the command too.
Delivery is what limits the attack. A normal git clone does not import a stranger’s configuration, so the repository has to arrive as files with .git already inside it: a zip archive, a shared drive, a sync folder, a USB stick.
What is patched and what is not
Anthropic fixed the core.fsmonitor path in Claude Code 2.1.196, three days after Manifold’s report on 26 June. Goose is fixed in 1.44.0 and OpenAI’s Codex CLI in 0.131.0, after versions 0.102.0 through 0.130.0 were affected. Cursor is patched. Four CVE identifiers have been issued so far: CVE-2026-19592 for Codex, CVE-2026-72718 for Goose, CVE-2026-55607 for a Claude Code worktree path, and CVE-2026-71963 for Hermes Agent.
Still open at the 1 September retest, according to Manifold: a second Claude Code path it reported, Hermes Agent, Qwen Code and Grok Build. The firm said four of its reports were closed as duplicates of other researchers’ submissions, and that Hermes Agent went untriaged after six attempts to make contact across several channels.
What to do now
Manifold’s advice to developers is to inspect .git/config for core.fsmonitor, core.hooksPath and filter settings before opening any directory that arrived as files rather than as a clone, or to switch the setting off globally with git config --global core.fsmonitor false. Its advice to vendors is to strip the repository’s configuration out of background git calls, for instance by passing -c core.fsmonitor=false.
No exploitation in the wild has been reported. The harder question is the one the research implies: agents keep adding startup work that reads untrusted files, and every addition is another place for the same trick to work.
