On September 1, 2026, Manifold Security published GitSpawn, a vulnerability class covering eight findings across seven AI coding agents: Claude Code, OpenAI Codex, Cursor, Goose, Hermes Agent, Qwen Code, and Grok Build. The summary line is blunt. “The repository names a command, git runs it, on the host, with the user’s privileges, before any approval prompt.”
The mechanism uses nothing exotic. Git has a performance setting, core.fsmonitor, whose value is a command that git executes to find changed files, and git reads it from the repository’s own .git/config. Any operation that refreshes the index, including git status and git diff, runs that command. Nearly every coding agent gathers project context by quietly shelling out to exactly those commands in the background as soon as a folder is opened. So the act of pointing an agent at a hostile repository is the exploit. The command executes as the user, outside the agent’s sandbox, and without an approval prompt, which means the sandbox and the permission dialog that users treat as the safety boundary are simply never consulted.
Two of the findings carried CVE identifiers at publication, CVE-2026-72718 for Goose and CVE-2026-71963 for Hermes. Cursor and Codex CLI were fixed. Claude Code had been patched on one path in June 2026, but Manifold confirmed a second path live on version 2.1.252 on September 1. Four of the eight findings remained unpatched at publication: the Claude Code ultrareview path, Qwen Code 0.22.3, Grok Build 1.0.13, and Hermes 0.21.0. The recommended vendor fix is to sanitise the config on background context calls, for example “git -c core.fsmonitor=false status”; individual users can set core.fsmonitor to false globally.
The lesson generalises past git. Agents are being wired into tools that were designed decades ago on the assumption that a human chose to run them and had already decided the working directory was trustworthy. An agent that opens an arbitrary repository, or clones one from an issue link, has quietly inverted that assumption, and the old tool has no idea. Reviewing which background commands your agent runs before you approve anything is now a real part of the threat model.