GitSpawn: Repo Git Config Runs Code in AI Coding Agents

What to do

1. Update every agent: Claude Code (claude update), Codex CLI 0.131.0 or later (npm i -g @openai/codex@latest), goose 1.44.0 or later, and Hermes Agent to a build containing commit f6234d0.
2. Before opening a repository that arrived as files, run git config --local --list in it and remove any core.fsmonitor, core.hooksPath or filter/diff driver entries you did not set.
3. Prefer a fresh git clone from the authenticated remote over unpacking someone else's working copy; a clone drops their local config.
4. Until Qwen Code, Grok Build and the Claude Code ultrareview path are fixed, do not run them on repositories received as files.
5. Run agents that handle untrusted code inside a container or VM without your real credentials.

How to check if you are affected or compromised

• Search received working copies for command-bearing settings: find ~/Downloads ~/Desktop -path '*/.git/config' -exec grep -il -e fsmonitor -e hookspath {} +
• Run git config --show-origin --get-regexp 'core\.(fsmonitor|hookspath)' in any repository you opened with an agent and check every hit points to a program you recognize.
• Check agent versions: claude --version, codex --version, goose --version.
• Review endpoint telemetry for unexpected processes spawned by git under an agent process, especially network tools or shells.

What happened#

On September 1, 2026, Manifold Security published GitSpawn: eight findings across seven command-line AI coding agents that share one root cause. Agents run git status or git diff in the background to learn about your branch and changed files. Those commands refresh git's index, and git then runs whatever program the repository's own .git/config names in core.fsmonitor. None of the affected agents stripped that setting. The command therefore runs as you, outside the agent's sandbox, with no approval prompt. In Claude Code and Hermes Agent it fired before the workspace-trust prompt was accepted.

The same day, OpenAI published CVE-2026-19592 (fsmonitor) and CVE-2026-19590 (the same idea via core.hooksPath in Codex Desktop). goose had already fixed its variant as CVE-2026-72718 (CVSS 4.0 7.0), and VulnCheck assigned CVE-2026-71963 (CVSS 4.0 8.6) to Hermes Agent on September 3. None of these CVEs is in CISA KEV, and no source reports exploitation.

Who is affected#

• Claude Code: the fsmonitor path, confirmed on 2.1.193, was fixed in 2.1.196 in late June. A second path through claude ultrareview, using a different git setting Manifold did not name, was still live on 2.1.252 when Manifold retested on September 1.
• Codex: CLI 0.102.0 through 0.130.0 (fixed in 0.131.0), plus the Desktop builds listed above (fixed in 26.519.x).
• goose: before 1.44.0, via goose review (GHSA-r5pp-p5r8-466r).
• Hermes Agent: 0.18.2 through 0.21.0. The fix, PR #101483 (commit f6234d0), was merged on September 2. Which release contains it was not disclosed as of October 21.
• Qwen Code and Grok Build: unpatched at publication. Cursor fixed its variant; the version was not disclosed.

Do you really need to act?#

The trigger is narrow, which is good news. A normal git clone does not copy the source repository's local config, so cloning a hostile URL does nothing. The attack needs the repository to arrive as files with .git intact: a zip or tarball someone sent you, a shared drive, a sync folder, a USB stick, or a candidate's take-home project. If that is how code reaches you, or if you run agents over uploaded repositories in a service, treat this as urgent. The payload runs with your full environment, including provider API keys and cloud credentials.

Updating closes most paths, and the agents auto-update in many setups. The Cloud Security Alliance notes that the Claude Code ultrareview path stayed open for weeks after the first fix. Fixing one setting does not fix the trust assumption, so inspect received repositories even after you update. A global core.fsmonitor=false does not help: a repository's local value overrides your global one.

What to do now#

1. Update: claude update (or npm i -g @anthropic-ai/claude-code@latest), npm i -g @openai/codex@latest for Codex 0.131.0 or later, and goose 1.44.0 or later. Bring Codex Desktop to 26.519.x or later.
2. Before opening a received directory with any agent, run git config --local --list inside it. Delete core.fsmonitor, core.hooksPath and filter or diff-driver entries you did not create.
3. Where you can, re-clone from the real remote instead of using someone else's working copy.
4. Keep Qwen Code, Grok Build and claude ultrareview away from repositories received as files until fixes ship.
5. Run agents that touch untrusted code in a disposable container or VM that holds no production credentials.

How to tell if you were hit#

List command-bearing settings in working copies you received: find ~/Downloads ~/Desktop -path '*/.git/config' -exec grep -il -e fsmonitor -e hookspath {} +. In each repository you opened with an agent, git config --show-origin --get-regexp 'core\.(fsmonitor|hookspath)' should return nothing, or only programs you installed. Check endpoint telemetry for shells or network tools spawned by git under an agent process. If you find a hostile value, assume the command ran. Rotate the API keys, cloud credentials and tokens present in that shell's environment.

Timeline#

• Jun 26, 2026 — Manifold reports the Claude Code fsmonitor path. It is fixed in 2.1.196.
• Jul 7–20, 2026 — Reports go to Qwen Code, Cursor, goose, Grok Build, Claude Code (ultrareview), Codex and Hermes Agent.
• Jul 24, 2026 — goose publishes GHSA-r5pp-p5r8-466r, fixed in 1.44.0. Its CVE record follows on Aug 10.
• Sep 1, 2026 — Manifold publishes GitSpawn. OpenAI publishes CVE-2026-19590 and CVE-2026-19592.
• Sep 2, 2026 — The Hermes Agent fix is merged, and The Hacker News reports the research.
• Sep 3, 2026 — CVE-2026-71963 (Hermes Agent) is published.

Vulnerability records

• CVE-2026-19592 · OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS automatically collected Git repository metadata without disabling the…
• CVE-2026-19590 · OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because automated Git operations trusted the repository's local…
• CVE-2026-72718 · goose is general-purpose AI agent that runs on your machine.
• CVE-2026-71963 · Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows attackers to execute arbitrary OS…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Manifold Security — GitSpawn: A Single Flaw Lets Untrusted Repos Run Code in Claude Code, Codex, Cursor, and Grok manifold.security
2. CVE record — CVE-2026-19592 (OpenAI Codex, core.fsmonitor) cve.org
3. CVE record — CVE-2026-19590 (OpenAI Codex Desktop, core.hooksPath) cve.org
4. goose — GHSA-r5pp-p5r8-466r: Arbitrary command execution via goose review and git core.fsmonitor github.com
5. CVE record — CVE-2026-72718 (goose) cve.org
6. CVE record — CVE-2026-71963 (Hermes Agent) cve.org
7. Nous Research — hermes-agent PR #101483: harden automatic git calls github.com
8. Cloud Security Alliance — GitSpawn research note labs.cloudsecurityalliance.org

Coverage and analysis

1. The Hacker News — Malicious .git configs can make Claude, Codex, Cursor and other AI agents run attacker code thehackernews.com