---
title: "GitSpawn: Repo Git Config Runs Code in AI Coding Agents"
url: https://erroneo.us/security/briefs/gitspawn-git-fsmonitor-ai-coding-agents/
description: "A repo's own .git/config makes Claude Code, Codex, goose, Hermes, Qwen Code and Grok Build run commands. Update agents and inspect repos received as files."
type: security-brief
section: "Security Digest"
date_published: 2026-09-01
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Patch this week"
cves: ["CVE-2026-19592", "CVE-2026-19590", "CVE-2026-72718", "CVE-2026-71963"]
severity: "high"
exploited: "public-poc"
kev: false
license: All rights reserved. Quote with attribution and a link.
---

# GitSpawn: Repo Git Config Runs Code in AI Coding Agents

**Verdict: Patch this week.** Update your coding agents this week and never point one at a repository that arrived as files until you have read its .git/config; ordinary clones are not affected, and no attacks have been reported.

- **Who must act:** Developers and teams running Claude Code, Codex, Cursor, goose, Hermes Agent, Qwen Code or Grok Build on repositories received as archives, shared drives, sync folders or USB media, and any service that runs an agent over uploaded repositories.
- **Who can relax:** People who only run agents inside repositories they cloned themselves from a known remote, because a normal git clone does not copy the source repository's local .git/config.
- **Affected:** Claude Code before 2.1.196 (core.fsmonitor path); a second path in claude ultrareview was still unpatched on 2.1.252 as of Sep 1, 2026; OpenAI Codex CLI 0.102.0 through 0.130.0; Codex Desktop macOS 260202.0859-26.513.31313, Windows 26.304.38-26.513.40821, Microsoft Store 26.304.38.0-26.513.4821.0; goose before 1.44.0; Hermes Agent 0.18.2 through 0.21.0; Qwen Code (confirmed on 0.19.6 and 0.22.3); Grok Build (confirmed on 0.2.93 and 1.0.13); Cursor CLI (versions not disclosed)
- **Fixed:** Claude Code 2.1.196 (core.fsmonitor path); Codex CLI 0.131.0; Codex Desktop 26.519.22136 (macOS), 26.519.21041 (Windows), 26.519.2081.0 (Microsoft Store); goose 1.44.0; Hermes Agent commit f6234d0 (merged Sep 2, 2026; release version not disclosed); Cursor (fixed per Manifold; version not disclosed); Qwen Code and Grok Build: no fix as of Sep 1, 2026
- **CVEs:** CVE-2026-19592, CVE-2026-19590, CVE-2026-72718, CVE-2026-71963
- **CISA KEV:** no · **Exploitation:** Public proof-of-concept

## What to do

1. Update every agent: Claude Code (claude update), Codex CLI 0.131.0 or later (npm i -g @openai/codex@latest), goose 1.44.0 or later, and Hermes Agent to a build containing commit f6234d0.
2. Before opening a repository that arrived as files, run git config --local --list in it and remove any core.fsmonitor, core.hooksPath or filter/diff driver entries you did not set.
3. Prefer a fresh git clone from the authenticated remote over unpacking someone else's working copy; a clone drops their local config.
4. Until Qwen Code, Grok Build and the Claude Code ultrareview path are fixed, do not run them on repositories received as files.
5. Run agents that handle untrusted code inside a container or VM without your real credentials.

### How to check if you are affected

- Search received working copies for command-bearing settings: find ~/Downloads ~/Desktop -path '*/.git/config' -exec grep -il -e fsmonitor -e hookspath {} +
- Run git config --show-origin --get-regexp 'core\.(fsmonitor|hookspath)' in any repository you opened with an agent and check every hit points to a program you recognize.
- Check agent versions: claude --version, codex --version, goose --version.
- Review endpoint telemetry for unexpected processes spawned by git under an agent process, especially network tools or shells.

## What happened

On September 1, 2026, Manifold Security published [GitSpawn](https://www.manifold.security/blog/ai-coding-agents-git-hijack): eight findings across seven command-line AI coding agents that share one root cause. Agents run `git status` or `git diff` in the background to learn about your branch and changed files. Those commands refresh git's index, and git then runs whatever program the repository's own `.git/config` names in `core.fsmonitor`. None of the affected agents stripped that setting. The command therefore runs as you, outside the agent's sandbox, with no approval prompt. In Claude Code and Hermes Agent it fired before the workspace-trust prompt was accepted.

The same day, OpenAI published [CVE-2026-19592](https://www.cve.org/CVERecord?id=CVE-2026-19592) (fsmonitor) and [CVE-2026-19590](https://www.cve.org/CVERecord?id=CVE-2026-19590) (the same idea via `core.hooksPath` in Codex Desktop). goose had already fixed its variant as [CVE-2026-72718](https://www.cve.org/CVERecord?id=CVE-2026-72718) (CVSS 4.0 7.0), and VulnCheck assigned [CVE-2026-71963](https://www.cve.org/CVERecord?id=CVE-2026-71963) (CVSS 4.0 8.6) to Hermes Agent on September 3. None of these CVEs is in CISA KEV, and no source reports exploitation.

## Who is affected

- **Claude Code:** the fsmonitor path, confirmed on 2.1.193, was fixed in 2.1.196 in late June. A second path through `claude ultrareview`, using a different git setting Manifold did not name, was still live on 2.1.252 when Manifold retested on September 1.
- **Codex:** CLI 0.102.0 through 0.130.0 (fixed in 0.131.0), plus the Desktop builds listed above (fixed in 26.519.x).
- **goose:** before 1.44.0, via `goose review` ([GHSA-r5pp-p5r8-466r](https://github.com/aaif-goose/goose/security/advisories/GHSA-r5pp-p5r8-466r)).
- **Hermes Agent:** 0.18.2 through 0.21.0. The fix, [PR #101483](https://github.com/NousResearch/hermes-agent/pull/101483) (commit f6234d0), was merged on September 2. Which release contains it was not disclosed as of October 21.
- **Qwen Code and Grok Build:** unpatched at publication. Cursor fixed its variant; the version was not disclosed.

## Do you really need to act?

The trigger is narrow, which is good news. A normal `git clone` does not copy the source repository's local config, so cloning a hostile URL does nothing. The attack needs the repository to arrive as files with `.git` intact: a zip or tarball someone sent you, a shared drive, a sync folder, a USB stick, or a candidate's take-home project. If that is how code reaches you, or if you run agents over uploaded repositories in a service, treat this as urgent. The payload runs with your full environment, including provider API keys and cloud credentials.

Updating closes most paths, and the agents auto-update in many setups. The [Cloud Security Alliance](https://labs.cloudsecurityalliance.org/research/csa-research-note-gitspawn-ai-coding-agent-rce-20260903-csa/) notes that the Claude Code ultrareview path stayed open for weeks after the first fix. Fixing one setting does not fix the trust assumption, so inspect received repositories even after you update. A global `core.fsmonitor=false` does not help: a repository's local value overrides your global one.

## What to do now

1. Update: `claude update` (or `npm i -g @anthropic-ai/claude-code@latest`), `npm i -g @openai/codex@latest` for Codex 0.131.0 or later, and goose 1.44.0 or later. Bring Codex Desktop to 26.519.x or later.
2. Before opening a received directory with any agent, run `git config --local --list` inside it. Delete `core.fsmonitor`, `core.hooksPath` and filter or diff-driver entries you did not create.
3. Where you can, re-clone from the real remote instead of using someone else's working copy.
4. Keep Qwen Code, Grok Build and `claude ultrareview` away from repositories received as files until fixes ship.
5. Run agents that touch untrusted code in a disposable container or VM that holds no production credentials.

## How to tell if you were hit

List command-bearing settings in working copies you received: `find ~/Downloads ~/Desktop -path '*/.git/config' -exec grep -il -e fsmonitor -e hookspath {} +`. In each repository you opened with an agent, `git config --show-origin --get-regexp 'core\.(fsmonitor|hookspath)'` should return nothing, or only programs you installed. Check endpoint telemetry for shells or network tools spawned by `git` under an agent process. If you find a hostile value, assume the command ran. Rotate the API keys, cloud credentials and tokens present in that shell's environment.

## Timeline

- Jun 26, 2026 — Manifold reports the Claude Code fsmonitor path. It is fixed in 2.1.196.
- Jul 7–20, 2026 — Reports go to Qwen Code, Cursor, goose, Grok Build, Claude Code (ultrareview), Codex and Hermes Agent.
- Jul 24, 2026 — goose publishes GHSA-r5pp-p5r8-466r, fixed in 1.44.0. Its CVE record follows on Aug 10.
- Sep 1, 2026 — Manifold publishes GitSpawn. OpenAI publishes CVE-2026-19590 and CVE-2026-19592.
- Sep 2, 2026 — The Hermes Agent fix is merged, and [The Hacker News](https://thehackernews.com/2026/09/malicious-git-configs-can-make-claude.html) reports the research.
- Sep 3, 2026 — CVE-2026-71963 (Hermes Agent) is published.

## Sources

1. [Manifold Security — GitSpawn: A Single Flaw Lets Untrusted Repos Run Code in Claude Code, Codex, Cursor, and Grok](https://www.manifold.security/blog/ai-coding-agents-git-hijack)
2. [CVE record — CVE-2026-19592 (OpenAI Codex, core.fsmonitor)](https://www.cve.org/CVERecord?id=CVE-2026-19592)
3. [CVE record — CVE-2026-19590 (OpenAI Codex Desktop, core.hooksPath)](https://www.cve.org/CVERecord?id=CVE-2026-19590)
4. [goose — GHSA-r5pp-p5r8-466r: Arbitrary command execution via goose review and git core.fsmonitor](https://github.com/aaif-goose/goose/security/advisories/GHSA-r5pp-p5r8-466r)
5. [CVE record — CVE-2026-72718 (goose)](https://www.cve.org/CVERecord?id=CVE-2026-72718)
6. [CVE record — CVE-2026-71963 (Hermes Agent)](https://www.cve.org/CVERecord?id=CVE-2026-71963)
7. [Nous Research — hermes-agent PR #101483: harden automatic git calls](https://github.com/NousResearch/hermes-agent/pull/101483)
8. [Cloud Security Alliance — GitSpawn research note](https://labs.cloudsecurityalliance.org/research/csa-research-note-gitspawn-ai-coding-agent-rce-20260903-csa/)
9. [The Hacker News — Malicious .git configs can make Claude, Codex, Cursor and other AI agents run attacker code](https://thehackernews.com/2026/09/malicious-git-configs-can-make-claude.html)

---
Source page: https://erroneo.us/security/briefs/gitspawn-git-fsmonitor-ai-coding-agents/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt