Am I at risk if I only clone repositories from GitHub?

Cloning, pulling and fetching do not copy a remote repository's .git/config, so GitSpawn does not travel that way. The risk is a project folder that arrives whole — a zip file from a colleague, a shared drive, or an archive downloaded from the web — because that copy brings its own .git directory and the poisoned config inside it.

Which coding agents are still unpatched?

Manifold Security lists Hermes Agent 0.21.0, Qwen Code 0.22.3 and Grok Build 1.0.13 as unpatched at publication, and reports a second unpatched path in Claude Code 2.1.252 through its ultrareview feature. Claude Code's core.fsmonitor path was fixed in 2.1.196, Goose in 1.44.0, and OpenAI Codex and Cursor are patched.

How do I check a folder before opening it with an agent?

Manifold Security's advice is to read .git/config before pointing an agent at a directory: any setting that names a program can run that program. core.fsmonitor is the one the research exploits, but the guidance is broader — treat any config key whose value is an executable path as untrusted code in an unfamiliar repository.

Does the agent's sandbox stop GitSpawn?

No. The point of GitSpawn is that git executes the command during context gathering, before the agent's workspace-trust prompt and outside the sandbox, so the payload runs with the developer's own privileges. From there it can reach SSH keys, cloud credentials, API tokens and every other repository on the machine.

Manifold Security · 2026-09-01 · major

GitSpawn — a repo's git config can run code in Claude Code, Codex and Cursor

GitSpawn is an attack Manifold Security published on September 1. A folder's own .git/config can name a program in core.fsmonitor, and a coding agent's routine git status runs it — outside the sandbox, before any trust prompt.

Manifold Security research graphic for the GitSpawn attack on AI coding agents — Manifold Security

A poisoned .git/config makes a coding agent's first git command run an attacker's program, before any approval prompt.

Quick facts

Researcher	Manifold Security
Published	September 1, 2026
Root cause	git reads core.fsmonitor from a repository's own .git/config
Patched	Claude Code 2.1.196, Goose 1.44.0, OpenAI Codex, Cursor
Still unpatched	Hermes Agent, Qwen Code, Grok Build
CVEs	CVE-2026-72718 (Goose), CVE-2026-71963 (Hermes Agent)
Mitigation	git -c core.fsmonitor=false status

What is it?

GitSpawn abuses a git setting called core.fsmonitor, which points at an external program git runs to speed up index checks. That setting lives in a repository's own .git/config, so a folder can carry it. Manifold Security published the research on September 1, 2026 with two assigned CVEs.

How does it work?

Command-line coding agents run git commands the moment you open a project — git status in Claude Code and Qwen Code, git diff in Goose — to work out what the repo contains. Git honours the full local config while doing so, calls whatever core.fsmonitor names, and does it on the host with your privileges. Because this happens during context gathering, it lands before the workspace-trust prompt and outside the agent's sandbox.

Why does it matter?

The dangerous case is a project folder handed to you whole rather than cloned — a zip from a colleague or a shared drive — since only those carry a .git/config an attacker chose. Vendors differ on where they stand: Claude Code, Goose, OpenAI Codex and Cursor have shipped fixes, while Hermes Agent, Qwen Code and Grok Build had not at publication. Until every agent sanitizes its own git calls, checking .git/config is the user's job.

Who is it for?

developers running command-line coding agents

Frequently asked questions

Am I at risk if I only clone repositories from GitHub?: Cloning, pulling and fetching do not copy a remote repository's .git/config, so GitSpawn does not travel that way. The risk is a project folder that arrives whole — a zip file from a colleague, a shared drive, or an archive downloaded from the web — because that copy brings its own .git directory and the poisoned config inside it.
Which coding agents are still unpatched?: Manifold Security lists Hermes Agent 0.21.0, Qwen Code 0.22.3 and Grok Build 1.0.13 as unpatched at publication, and reports a second unpatched path in Claude Code 2.1.252 through its ultrareview feature. Claude Code's core.fsmonitor path was fixed in 2.1.196, Goose in 1.44.0, and OpenAI Codex and Cursor are patched.
How do I check a folder before opening it with an agent?: Manifold Security's advice is to read .git/config before pointing an agent at a directory: any setting that names a program can run that program. core.fsmonitor is the one the research exploits, but the guidance is broader — treat any config key whose value is an executable path as untrusted code in an unfamiliar repository.
Does the agent's sandbox stop GitSpawn?: No. The point of GitSpawn is that git executes the command during context gathering, before the agent's workspace-trust prompt and outside the sandbox, so the payload runs with the developer's own privileges. From there it can reach SSH keys, cloud credentials, API tokens and every other repository on the machine.

Try it

grep -n fsmonitor .git/config before opening an unfamiliar folder with an agent