GitSpawn Flaw in AI Coding Agents Executes Malicious Commands via Git Configurations
Researchers at Manifold Security disclosed a vulnerability class dubbed GitSpawn that affects multiple AI-powered developer tools, including Claude Code, Cursor, OpenAI Codex, Goose, Hermes Agent, Grok Build, and Qwen Code. The issue stems from how coding agents automatically gather repository context on launch by executing background commands like `git status` or `git diff` before receiving user input or establishing workspace trust boundaries. When a developer opens a project directory pre-populated with a `.git` folder, the local repository configuration dictates how Git executes certain features. The primary attack vector leverages Git's legitimate `core.fsmonitor` configuration, which is designed to call external helper utilities to optimize file-change monitoring in massive codebases. Because the automated agents run background Git commands without first sanitizing local repository settings, Git parses the attacker-supplied `core.fsmonitor` value and executes the specified executable on the host system. The resulting payload runs with the developer's logged-in permissions, completely bypassing standard AI sandboxing and prompt-based confirmation dialogues. Standard operations like `git clone` or `git pull` do not carry local repository configuration files, meaning attacks rely on direct directory transfers like ZIP archives, shared storage drives, or sync folders. Researchers identified eight distinct vulnerabilities across the affected agents, observing that the spawned processes run entirely in the background without UI alerts or user interaction. Remediation has begun across the industry, with Goose patching CVE-2026-72718 in version 1.44.0 and Claude Code addressing its `core.fsmonitor` vector in version 2.1.196 alongside fixes for Cursor and Codex. However, several products remained vulnerable at disclosure time, including Hermes Agent (CVE-2026-71963) in version 0.21.0, Grok Build version 1.0.13, Qwen Code version 0.22.3, and an additional unpatched `ultrareview` configuration execution sink in Claude Code.
Commentary
The root cause here is an old problem wearing a shiny new AI wrapper: implicit trust in local workspace state. For years, IDEs fought the battle of opening arbitrary folders without executing project-level configurations or build tasks automatically. AI developer tools rushed ahead with aggressive background context-gathering engines to make agents appear intelligent and immediate, inadvertently undoing those safe defaults. Any developer or security auditor who ingests raw project archives, downloaded sample repositories, or contractor deliverables into AI agent-enabled workspaces is directly exposed. Because the execution triggers immediately on folder load—prior to trust prompts or chat input—payloads operate silently with the privileges of the local shell, enabling the extraction of `~/.ssh` keys, cloud access tokens, and environment secrets. Engineering teams must audit the startup workflows of custom or internal developer agents. Background subprocess calls must always disable local repository configurations using flags like `git -c core.fsmonitor=""` or strictly operate within isolated, read-only containers until explicit workspace trust is confirmed.
The Quote to Remember
“In some cases, this Git activity occurs before the user has a chance to enter a prompt, approve a workspace-trust dialog, or authenticate with the service.”
“The potential impact is severe because the spawned process operates outside the AI agent’s usual sandbox and approval workflow.”