GitSpawn: untrusted repo git configs can run code in coding agents

Opening a folder in a coding agent is supposed to be context collection, not a code-execution event. Manifold Security’s GitSpawn research, published 1 September 2026 by offensive security engineer Francisco Rosales, shows that for several CLI agents it can be both. The agents spawn git at session start, honor a folder’s own .git/config, and can run a helper on the host before any trust prompt. The failure is plumbing, not a model jailbreak.

Git decides what git runs

What an agent asks git for is ordinary: the current branch, which files are dirty, which paths a change touched. Manifold quotes typical subprocesses such as git status --porcelain=2 --branch and git diff --name-only HEAD. Both refresh the index. That refresh is the sink.

core.fsmonitor is a documented performance setting for large repositories. Instead of checking every file, git asks a helper what changed. It reads that setting from the repository’s own .git/config. A repo can ship:

[core]
 fsmonitor = <command>

Any index-refreshing command then runs it. Manifold notes that core.fsmonitor is not the only setting of its kind, which is why one of its findings is not an fsmonitor bug at all. The post leaves that other key unnamed while the matching path remained unpatched.

Because the agent’s own code launches git, the helper runs as the developer, outside the sandbox, with no approval UI. The permission model never sees a tool call.

Why clone is the wrong threat model

Git does not carry this payload across the network. Cloning a hostile URL does nothing; neither does fetch or pull. The repository has to arrive as files with .git already inside: a shared zip, a USB stick, a sync folder, a shared drive. Manifold used a .zip for every proof of concept.

OpenAI’s NVD record CVE-2026-19592 states the same limit for Codex: exploitation requires a repository delivered or copied with local .git/config intact. An ordinary clone does not preserve the source repo’s local config.

That is the practitioner detail that matters. Unzipping a client project, opening a synced directory, or plugging in a stick is a different trust decision from git clone.

Eight findings, seven agents

Manifold published eight findings across seven agents and said it found the same pattern in products it did not name. Five reports came back as duplicates of work other researchers had already filed, one on the same day. Status below is Manifold’s 1 September 2026 retest, not a live vendor check.

Patched in that snapshot:

Claude Code (core.fsmonitor). Startup git status as an internal subprocess, outside the sandbox, before the workspace-trust prompt. Confirmed on 2.1.193; fixed by 2.1.196. Reported 26 June 2026 and closed as a duplicate of a same-day report.
Goose. Built a review diff with git diff, passing core.quotePath=off and stripping nothing. Triggered by goose review. Affected 1.41.0 (reported 13 July); fixed in 1.44.0 as CVE-2026-72718, scored 7.0 by the maintainers.
OpenAI Codex. Reported 20 July 2026, closed as a duplicate, patched. Manifold says the Codex variant differs somewhat in mechanism but belongs to the same class.
Cursor. Reported 8 July 2026, closed as a duplicate, patched.

CVE-2026-19592 fills in Codex. Codex CLI for Windows, macOS, and Linux, and Codex Desktop for Windows and macOS, collected Git metadata without disabling repository-local core.fsmonitor. The helper runs outside Codex’s command sandbox and without a user-approval prompt, with the user’s privileges. CISA-ADP scores it 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) under CWE-15. NVD lists CLI 0.102.0 through 0.130.0 as affected and 0.131.0 as unaffected, with separate affected and fixed ranges for desktop and Microsoft Store builds.

Still executing repo-supplied commands in the 1 September retest:

Hermes Agent 0.21.0. git status after the first message. Confirmed earlier on 0.18.2. CVE-2026-71963 assigned by VulnCheck. Manifold describes six contact attempts across five channels with no triage.
Qwen Code 0.22.3. git status on start-up, even before authentication. Reported 7 July 2026 to Alibaba’s security response centre and accepted; first confirmed on 0.19.6.
Grok Build 1.0.13. Execution on the first keystroke, before a message is sent. An earlier same-class report filed 1 July 2026 had been closed as informative.
Claude Code ultrareview. A second git-config sink on claude ultrareview, not core.fsmonitor. Payload on startup, before the workspace-trust prompt is shown. Reported 15 July 2026 on 2.1.210; confirmed still present on 2.1.252.

The Hacker News ran a 2 September 2026 headline on malicious .git configs making Claude, Codex, Cursor, and other AI agents run attacker code.

What an attacker gets

Manifold’s description is blunt: arbitrary code execution as the developer, nothing on screen. SSH keys, cloud credentials in the environment, tokens in shell config, every repository on disk, a foothold on the machine. Some agents gather this context before the user types, before workspace trust, and in Qwen Code’s case before login.

The research cites Claude Code at over 77 million npm downloads a month (npm API, 28 July–27 August 2026) and GitHub stars across Hermes (over 237,000), Claude Code (143,000+), Goose (54,000+), Qwen Code (27,000+), and Grok Build (26,000) approaching half a million together. The point is prevalence of the startup-git pattern, not a single product.

Harden the subprocess, inspect the folder

If you receive a repository as files, inspect .git/config before opening it with an agent. Any setting that names a program can run it.

If you ship a coding agent, sanitize git config on background context calls. Manifold’s example is git -c core.fsmonitor=false status. Other execution sinks need the same treatment.

Treat zips, USB drops, and synced folders as untrusted for this class. A clone from a URL does not deliver the local config.

Read Manifold’s GitSpawn post for the per-agent sinks and the publication table, then verify your current agent build against vendor notes and, if you use Codex, against CVE-2026-19592. Do not treat a 1 September “unpatched” row as today’s status without that check.