#GitSpawn

GitSpawn Flaw in AI Coding Agents Executes Malicious Commands via Git Configurations

Researchers at Manifold Security disclosed a vulnerability class dubbed GitSpawn that affects multiple AI-powered developer tools, including Claude Code, Cursor, OpenAI Codex, Goose, Hermes Agent, Grok Build, and Qwen Code. The issue stems from how coding agents automatically gather repository context on launch by executing background commands like `git status` or `git diff` before receiving user input or establishing workspace trust boundaries. When a developer opens a project directory pre-populated with a `.git` folder, the local repository configuration dictates how Git executes certain features. The primary attack vector leverages Git's legitimate `core.fsmonitor` configuration, which is designed to call external helper utilities to optimize file-change monitoring in massive codebases. Because the automated agents run background Git commands without first sanitizing local repository settings, Git parses the attacker-supplied `core.fsmonitor` value and executes the specified executable on the host system. The resulting payload runs with the developer's logged-in permissions, completely bypassing standard AI sandboxing and prompt-based confirmation dialogues. Standard operations like `git clone` or `git pull` do not carry local repository configuration files, meaning attacks rely on direct directory transfers like ZIP archives, shared storage drives, or sync folders. Researchers identified eight distinct vulnerabilities across the affected agents, observing that the spawned processes run entirely in the background without UI alerts or user interaction. Remediation has begun across the industry, with Goose patching CVE-2026-72718 in version 1.44.0 and Claude Code addressing its `core.fsmonitor` vector in version 2.1.196 alongside fixes for Cursor and Codex. However, several products remained vulnerable at disclosure time, including Hermes Agent (CVE-2026-71963) in version 0.21.0, Grok Build version 1.0.13, Qwen Code version 0.22.3, and an additional unpatched `ultrareview` configuration execution sink in Claude Code.