TITLE: GitSpawn: One Line in a Repo's Config Can Run Code Inside Claude Code, Codex and Cursor DATE: 2026-09-13 COMPANY: Manifold Security TOPIC: AI Security SUMMARY: Security researchers at Manifold Security disclosed GitSpawn, a vulnerability class affecting seven AI coding agents including Claude Code, OpenAI Codex, Cursor, Grok Build and Goose. A single line in a repository's .git/config file can trigger arbitrary code execution the moment an agent runs a routine background git status, before any workspace trust prompt. Four of eight identified flaws remained unpatched as of a September 1 retest. WHAT CHANGED: Manifold Security identified that AI coding agents routinely run git status as a background operation to gather repository context, often before workspace trust checks or user authentication. Git reads a file called .git/config when running these commands. One field in that file, core.fsmonitor, is a legitimate performance setting that specifies a shell command for Git to run when refreshing the index. Git executes whatever is in this field automatically, without any prompt. The consequence is that any repository with a crafted .git/config can execute attacker-controlled shell commands the moment an AI coding agent opens it. Because the agent has access to the developer's credentials, SSH keys and local file system, the scope of what those commands can reach is determined by the developer's own access level. Manifold tested seven agents against a purpose-built exploit repository and found that all seven executed the malicious payload. The researchers reported findings to each vendor and conducted a retest on September 1. Codex and Cursor had patched their respective vulnerabilities. Four flaws across the remaining agents were still exploitable. The core issue, as Manifold frames it, is a trust ordering problem: agents gather context before they verify trust. Resolving it does not require a complex architectural change. Adding a single flag, `git -c core.fsmonitor=false status`, disables the vulnerable feature for any individual command without affecting repository function. WHY IT MATTERS: AI coding agents are no longer optional tooling for development teams. They are being procured, standardised and deployed across teams as productivity infrastructure. The security review applied to them has not kept pace with the access they have been granted. The GitSpawn class of vulnerability does not require social engineering or phishing. It requires only that a developer or an automated pipeline opens a repository that a threat actor has been able to modify. In many development environments, this includes third-party dependencies, public open-source repositories and code review workflows. Developer credentials and SSH keys are a high-value target. In the sequence Manifold describes, those credentials are accessible to whatever code the .git/config executes. This is not a hypothetical escalation path. It is the default access model of the environments where these tools run. The breadth of the disclosure, across seven agents from five vendors, signals that this is a category error in how the agent class was designed, not an isolated implementation mistake. Each team rebuilt a similar context-gathering loop with a similar assumption about when trust verification should occur. Finally, the patch status matters. Two of seven agents had shipped fixes by the September 1 retest. Four flaws remained open. For enterprise teams that have deployed these tools, an unpatched version installed three months ago is the version that is exploitable now. The parallel Accomplish disclosure about sandbox vulnerabilities, and CVE-2026-35603 affecting shared ProgramData directories, suggest that AI coding agent security is entering a period of concentrated researcher attention. More disclosures of this class are likely. DAVID & GOLIATH ANALYSIS: The story that gets reported is the clever technical detail. A .git/config line fires a shell command and the agent executes it. That is the kind of detail that travels well on developer forums. What does not travel as well is the organisational context: who approved this tool for use across the team, what access did they understand it to have, and who is responsible for making sure the version installed last quarter is still the version you should be running. For the operators we work with, AI coding tools sit in a governance gap. They are treated as IDE features, not as software agents with credential access. The security review that would apply to a new SaaS integration, covering access scope, data handling, update policy and vulnerability response, rarely applies to a tool that was installed from a marketplace and left to update on its own schedule. GitSpawn closes that gap by force. Four unpatched flaws, publicly documented, across tools used by millions of developers, is a situation that demands a response. The response worth having is not just patching the specific CVE. It is building a repeatable process for knowing which AI tools are deployed, what they can access, and how quickly you can verify and apply a security update when the next disclosure arrives. RELEVANT SYSTEMS: Secure AI Brain, Employee Amplification Systems SOURCE URL: https://davidandgoliath.ai/daily-ai-briefing/gitspawn-ai-coding-agent-vulnerability-claude-codex-cursor FEED URL: https://davidandgoliath.ai/daily-ai-briefing/feed --- Published by David & Goliath | https://davidandgoliath.ai Daily AI Briefing: one AI development per day, decoded for business operators. This is a structured companion file optimised for LLM retrieval and citation.