GitSpawn: a malicious .git config runs code in your AI coding agent
It fires from a repo you open as files, not one you clone. Codex and Cursor are patched; Qwen Code, Grok Build, Hermes and one Claude Code path aren't.
Copy markdown
How it works: git runs the repo's own command
A repo's .git/config can point core.fsmonitor at any command. Your agent runs git status or git diff to gather context, git executes it — on your machine, with your privileges, before any approval prompt. No prompt injection or sandbox escape required.
The one thing that saves you: how the repo arrived
Cloning a hostile URL is safe — git ignores fsmonitor from a fresh clone. The trap is a repo delivered as raw files with an intact .git folder: a .zip, a shared drive, a USB stick. Open that in your agent and the payload fires.
Who's patched — and who still isn't
Codex and Cursor are patched; Goose fixed it in 1.44.0 (CVE-2026-72718). Claude Code closed the fsmonitor path in 2.1.196 but a second 'ultrareview' path was still live against 2.1.258 as of Sept 1. Hermes Agent (CVE-2026-71963), Qwen Code and Grok Build remain unpatched.
Do this now: check .git/config before you open
Before pointing an agent at any repo you received as files, inspect .git/config for settings that reference an executable — fsmonitor or hooks. The vendor fix strips config on background calls: git -c core.fsmonitor=false status. On an unpatched agent, wrap git that way yourself.
Five researchers found it independently
Manifold's disclosure drew five 'duplicate' responses from other researchers — the technique is already widely known. Treat any untrusted repo as capable of running code, and don't hand your agent a codebase you didn't clone yourself.