A newly disclosed class of vulnerabilities, dubbed GitSpawn, allows a booby-trapped repository to silently execute code on a developer’s machine the moment it is opened with an AI coding agent, no prompt typed, no approval clicked, and in some cases before the user has even authenticated.
Security researchers at Manifold Security found the flaw while investigating what CLI-based coding agents actually do on startup, as detailed in the technical disclosure published by Manifold Security.
Nearly every agent they examined gathers project context by quietly running git commands like git status or git diff in the background. That behavior is unremarkable on its own, but each of these commands triggers git to refresh its internal index, and that refresh is where the danger lies.
Git supports a performance setting called core.fsmonitor, which lets a repository specify a helper program that git runs automatically whenever the index refreshes. It is documented intended functionality, but it is read straight out of the repository’s own .git/config file.
That means a malicious repository can embed an arbitrary command in its configuration, and the moment an AI agent runs a routine context-gathering git command inside it, that command executes with the full privileges of the logged-in user, outside the sandbox and completely invisible to any permission system.
The attack cannot be delivered through a normal git clone, fetch, or pull, since those operations never transmit a hostile .git/config, reads the Manifold Security report.
Instead, the poisoned repository has to arrive as files, its .git directory intact, through a zipped folder, a shared drive, a synced directory, or a USB stick, exactly the way colleagues and consultants routinely hand off projects.
| Tool / Platform | Vulnerability Mechanism | Severity & Remediation Status |
| Git Core Configuration | core.fsmonitor hook executed on background index refresh |
Arbitrary local command execution outside agent sandboxes |
| Claude Code | Automatic git context queries and ultrareview key abuse |
Four unpatched flaws tracked; 77M+ monthly npm downloads |
| Goose | Background context-gathering git command triggers | Fixed in latest vendor build; assigned CVE-2026-72718 |
| Hermes Agent | Unsanitized repository startup execution | Vendor unresponsive after six attempts; assigned CVE-2026-71963 |
| Cursor & Codex | Variant repository configuration execution | Both vendors shipped patches following independent discovery |
| Qwen Code & Grok Build | Startup context-gathering git invocation | Vulnerable to unauthenticated pre-execution file compromise |
The research team confirmed the flaw across Claude Code, Goose, Hermes Agent, Qwen Code, and Grok Build, together representing close to half a million GitHub stars and, in Claude Code’s case alone, more than 77 million monthly npm downloads.
OpenAI’s Codex and Cursor were also found to be affected through variants of the same class; both were patched after being reported, though each was flagged as a duplicate of findings other researchers had independently filed.
Of the eight issues tracked, four remain unpatched at publication, including a distinct flaw in Claude Code’s ultrareview command that abuses a different git configuration key rather than core.fsmonitor, deliberately left unnamed to avoid handing attackers a working template.
Goose has already shipped a fix and received CVE-2026-72718, while Hermes was independently assigned CVE-2026-71963 after the vendor failed to respond across six contact attempts.
Developers who receive a repository as raw files rather than through a clone should inspect .git/config before opening it in any AI agent.
Vendors, meanwhile, are being urged to sanitize git configuration during background context-gathering calls, for instance by explicitly disabling core.fsmonitor, to close off this entire class of silent, pre-authentication code execution.
Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
The post GitSpawn Flaws Let Malicious Repositories Execute Code in Claude Code, Codex, Cursor, and Grok appeared first on Cyber Security News.