On September 1, 2026, Manifold Security published GitSpawn: eight code-execution findings across seven command-line coding agents. Claude Code, OpenAI Codex, Cursor, Block's Goose, Alibaba's Qwen Code, xAI's Grok Build and Nous Research's Hermes Agent all failed the same test. Four of the eight findings were still open at retest on the day the research went public.
What happened
Every one of these agents gathers context when you point it at a directory. It runs git status in the background to learn which branch it is on and which files changed. Git reads configuration from the repository itself, and a .git/config that sets core.fsmonitor to a command causes Git to run that command during the index refresh. The agent triggers the refresh on its own, before a prompt is typed and before any tool-use approval. The command executes as the developer, outside the agent sandbox, with nothing on screen.
Exploitation needs the repository to arrive with its .git directory intact: a shared archive, a sync folder, a shared drive, a USB stick. An ordinary clone does not carry the attacker's config. Manifold documented the same class in Cursor CLI three weeks earlier, where a repository-supplied setup command ran before the workspace-trust prompt.
| Agent | Status at September 1 retest |
|---|---|
| Claude Code | core.fsmonitor path fixed in 2.1.196 (CVE-2026-55607). A second path through claude ultrareview still open, key withheld by the researchers. |
| OpenAI Codex | Fixed. CVE-2026-19592 covers CLI 0.102.0 through 0.130.0; CVE-2026-19593 covers a desktop build. |
| Cursor | Fixed after independent reports. |
| Goose | Fixed in 1.44.0, CVE-2026-72718. |
| Hermes Agent | Open at 0.21.0, CVE-2026-71963 assigned after six unanswered contact attempts. |
| Qwen Code | Open at 0.22.3. |
| Grok Build | Open at 1.0.13. |
Why it matters
The story is not that a Git feature can run commands; that has been true for years. The story is that the agent runs Git on your behalf before you have agreed to anything, and the execution lands outside the sandbox the vendor sold you. Every in-agent control on the market, the OS sandbox, the approval prompt, the workspace-trust dialog, sits after this step. The class of "runs before trust" bugs has now been reported against Claude Code twice, and the vendor advisory record did not cover either finding as of September 2.
What to do
- 01Set core.fsmonitor off globally on every developer machine and CI runner: git config --global core.fsmonitor false. This closes the primary vector regardless of which agent is installed.
- 02Update Claude Code past 2.1.196, Codex CLI past 0.131.0, Goose past 1.44.0, and current Cursor. Treat Hermes Agent, Qwen Code and Grok Build as vulnerable until a fix ships.
- 03Never open a repository received as raw files in a coding agent without inspecting .git/config first.
- 04Put developer workstations and runners under a resolver policy in Enforce mode, so a first-stage that reaches for an unfamiliar host is held and logged.
git config --global core.fsmonitor false
git config --global --get core.fsmonitor # expected: false
getent hosts first-seen-$(date +%s).example # expected: <block page address> under a Securd policy