Security researchers have uncovered eight flaws across seven command-line AI coding assistants that let a repository's own Git settings trigger commands on a developer's computer without approval. Manifold Security disclosed the vulnerabilities—dubbed GitSpawn—on September 2, revealing that four remain unpatched while fixes have shipped for goose, Claude Code, and Cursor. The commands execute with full user privileges, outside any protective sandbox, and fire when the repository arrives as files with its .git directory preserved through archives, shared drives, sync folders, or USB sticks.
The attack hinges on core.fsmonitor, a Git performance feature whose value names a command that Git runs to track changed files, and Git reads this setting directly from the repository's own .git/config file. Any index refresh—including git status or git diff—executes that command, and the agents call these operations in the background to determine the current branch and modified files without sanitizing the repository's configuration. On Claude Code and Hermes Agent, the payload fires before the workspace-trust prompt appears; on Qwen Code, before authentication completes; and on Grok Build, on the first keystroke. OpenAI published three CVEs on September 1 covering the identical vulnerability class in Codex, credited to three separate research teams. Affected versions include goose before 1.44.0, Codex CLI 0.102.0 through 0.130.0, Codex Desktop builds through late August, Claude Code 2.1.193, Hermes Agent 0.18.2 and 0.21.0, Qwen Code 0.19.6 and 0.22.3, and Grok Build 0.2.93 and 1.0.13.
"The helper runs outside Codex's command sandbox and without a user-approval prompt, allowing attacker-controlled code to run with the user's privileges," OpenAI stated in CVE-2026-19592. Manifold wrote that the flaw "is not in the model, or in anything new. It is in the ordinary plumbing underneath, the subprocess an agent spawns at session startup to work out where it is." The goose review command, for example, constructs its Git invocations with one configuration flag and strips nothing else, meaning running the command inside a malicious repository executes attacker code before the agent contacts the model. GitHub assigned CVE-2026-72718 a CVSS 4.0 base score of 7.0 in an advisory crediting Francisco Rosales—the only severity rating any of these findings carry.
Five of Manifold's reports came back as duplicates of findings other researchers had filed independently, one on the same day, and no source documents exploitation of any of these vulnerabilities. The U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog, version 2026.09.01 with 1,687 entries, lists none of the CVEs as of September 2. The researchers reported the Claude Code core.fsmonitor issue on June 26, and it was fixed by version 2.1.196 on June 29, but Anthropic published no advisory and the vendor's npm package record covers neither of the Claude Code paths. A second Claude Code route through the claude ultrareview command, which Manifold withheld details on while the issue remains live, was confirmed present on version 2.1.252 on September 1, against current release 2.1.258. Alibaba's security response center accepted the Qwen Code report on July 7, but 0.22.3 remains the latest published release as of September 2. Hermes Agent left the private advisory untriaged after six contact attempts across five channels, and xAI closed Manifold's July 14 Grok Build report as a duplicate of an earlier submission it had marked informative. Users should inspect .git/config files before opening received directories with agents, run git config --get core.fsmonitor inside any repository that arrived as files, and consider setting git config --global core.fsmonitor false to disable the feature by default. The automation that makes AI coding assistants efficient creates new attack surfaces that legacy security models weren't designed to intercept, and organizations adopting these tools will need to rethink repository-handling protocols to match the threat.