GitSpawn: One Line in a Repo's Config Can Run Code Inside Claude Code, Codex and Cursor

30-Second Summary

Manifold Security disclosed a vulnerability class called GitSpawn in which a repository's .git/config file can execute arbitrary code the moment an AI coding agent runs a background git status. The attack requires no special privileges and fires before workspace trust prompts. Seven agents were tested, all seven failed, and four of eight identified flaws remained unpatched after a September 1 follow-up check.

At a Glance

• Topic: AI Security, Developer Tooling
• Company: Manifold Security (researcher), affected vendors: Anthropic (Claude Code), OpenAI (Codex), Anysphere (Cursor), xAI (Grok Build), Block (Goose), Alibaba (Qwen Code), Hermes Agent
• Date: September 2026
• Announcement: Full technical disclosure of GitSpawn vulnerability class across seven AI coding agents
• What Changed: A legitimate Git configuration feature (core.fsmonitor) is being exploited to execute attacker-controlled commands inside AI agent sessions
• Why It Matters: AI coding agents have access to developer credentials, SSH keys and source code. A single malformed repository can trigger code execution without any user interaction
• Who Should Care: Any development team using AI coding assistants, any security team responsible for developer toolchain risk, and any operator planning to deploy AI coding agents to their team

Key Facts

• Eight distinct flaws were identified across seven agents: Claude Code, OpenAI Codex, Cursor, Grok Build, Goose, Qwen Code, and Hermes Agent (Manifold Security, September 2026)
• All seven agents failed Manifold's test suite
• OpenAI Codex and Cursor shipped patches before or shortly after disclosure; Cursor's fix tracked as CVE-2026-48124, resolved in version 3.0.0
• At a September 1 retest, four of eight flaws remained exploitable: Hermes Agent, Qwen Code, Grok Build, and a second Claude Code configuration path
• No confirmed exploitation in the wild as of the initial disclosure
• A parallel disclosure by Accomplish, a stealth security startup, identified leaky sandbox vulnerabilities across Claude Code, OpenAI Codex and Cursor earlier in the same period
• A separate privilege escalation flaw tracked as CVE-2026-35603 affects Claude Code, Cursor, Codex CLI and Gemini CLI through insecure ProgramData configurations

What Happened

Manifold Security identified that AI coding agents routinely run git status as a background operation to gather repository context, often before workspace trust checks or user authentication. Git reads a file called .git/config when running these commands. One field in that file, core.fsmonitor, is a legitimate performance setting that specifies a shell command for Git to run when refreshing the index. Git executes whatever is in this field automatically, without any prompt.

The consequence is that any repository with a crafted .git/config can execute attacker-controlled shell commands the moment an AI coding agent opens it. Because the agent has access to the developer's credentials, SSH keys and local file system, the scope of what those commands can reach is determined by the developer's own access level.

Manifold tested seven agents against a purpose-built exploit repository and found that all seven executed the malicious payload. The researchers reported findings to each vendor and conducted a retest on September 1. Codex and Cursor had patched their respective vulnerabilities. Four flaws across the remaining agents were still exploitable.

The core issue, as Manifold frames it, is a trust ordering problem: agents gather context before they verify trust. Resolving it does not require a complex architectural change. Adding a single flag, git -c core.fsmonitor=false status, disables the vulnerable feature for any individual command without affecting repository function.

Why It Matters

AI coding agents are no longer optional tooling for development teams. They are being procured, standardised and deployed across teams as productivity infrastructure. The security review applied to them has not kept pace with the access they have been granted.

The GitSpawn class of vulnerability does not require social engineering or phishing. It requires only that a developer or an automated pipeline opens a repository that a threat actor has been able to modify. In many development environments, this includes third-party dependencies, public open-source repositories and code review workflows.

Developer credentials and SSH keys are a high-value target. In the sequence Manifold describes, those credentials are accessible to whatever code the .git/config executes. This is not a hypothetical escalation path. It is the default access model of the environments where these tools run.

The breadth of the disclosure, across seven agents from five vendors, signals that this is a category error in how the agent class was designed, not an isolated implementation mistake. Each team rebuilt a similar context-gathering loop with a similar assumption about when trust verification should occur.

Finally, the patch status matters. Two of seven agents had shipped fixes by the September 1 retest. Four flaws remained open. For enterprise teams that have deployed these tools, an unpatched version installed three months ago is the version that is exploitable now.

The parallel Accomplish disclosure about sandbox vulnerabilities, and CVE-2026-35603 affecting shared ProgramData directories, suggest that AI coding agent security is entering a period of concentrated researcher attention. More disclosures of this class are likely.

The David and Goliath View

The story that gets reported is the clever technical detail. A .git/config line fires a shell command and the agent executes it. That is the kind of detail that travels well on developer forums. What does not travel as well is the organisational context: who approved this tool for use across the team, what access did they understand it to have, and who is responsible for making sure the version installed last quarter is still the version you should be running.

For the operators we work with, AI coding tools sit in a governance gap. They are treated as IDE features, not as software agents with credential access. The security review that would apply to a new SaaS integration, covering access scope, data handling, update policy and vulnerability response, rarely applies to a tool that was installed from a marketplace and left to update on its own schedule.

GitSpawn closes that gap by force. Four unpatched flaws, publicly documented, across tools used by millions of developers, is a situation that demands a response. The response worth having is not just patching the specific CVE. It is building a repeatable process for knowing which AI tools are deployed, what they can access, and how quickly you can verify and apply a security update when the next disclosure arrives.

Where This Fits in the AI Stack

AI coding agents represent a layer of the AI stack that sits closest to production credentials and source code. Unlike browser-based AI tools or API integrations, they operate inside development environments with access to file systems, git histories, environment variables and SSH configurations. The security posture required for this layer is closer to endpoint security than to SaaS governance.

GitSpawn is a reminder that agentic tools inherit the attack surface of every system they interact with. An agent that runs git commands inherits the risk surface of git. An agent that reads environment variables inherits whatever secrets are stored there. The security review for AI agent adoption needs to map that inheritance, not just review the agent's own permission set.

Questions Operators Are Asking

Do we need to stop using these tools while flaws are unpatched? Not necessarily, but you need to know which version is installed and whether it is affected. Codex and Cursor have shipped patches. If your team uses those, verify the installed version matches the patched release. For the four still-unpatched agents, assess your exposure based on which repositories they access and whether those could be modified by a third party.

How would we know if we had been compromised via this vector? The executed payload runs with developer-level credentials, so detection depends on what those credentials do after the fact. Endpoint logging on developer machines, credential usage monitoring, and SSH key audit trails are the relevant signals. If you do not have those in place, this is a good prompt to implement them.

Is this an Anthropic problem, an OpenAI problem, or a git problem? It is a problem with how the agent class was designed. Git's core.fsmonitor feature works as documented. The agent vendors made an implementation choice to run git context-gathering before trust verification. The fix is straightforward and each vendor owns it.

What should we tell the team right now? Two things: do not clone untrusted repositories using AI coding agents until you have verified you are running a patched version, and treat any alert about unexpected shell command execution or unusual credential usage as potentially related to this vulnerability class.

When will all the affected agents be patched? Manifold's September 1 retest showed four flaws still open. Patch timelines for the remaining vendors have not been publicly committed to as of this writing. Monitor each vendor's security advisories for updates.

Citable Summary

Manifold Security disclosed GitSpawn in September 2026, identifying eight vulnerabilities across seven AI coding agents including Claude Code, Codex and Cursor. The attack exploits Git's core.fsmonitor configuration field to execute arbitrary code when an agent runs a routine git status. All seven agents failed testing. Codex and Cursor shipped patches; four flaws remained unpatched at the September 1 retest. No exploitation in the wild was confirmed at the time of disclosure.