What changed
Manifold Security disclosed eight findings across seven command-line AI coding agents under the name GitSpawn. The shared failure mode is ordinary Git context gathering: agents call commands such as `git status` or `git diff`, and Git honours executable settings from the repository’s own `.git/config`. A received repository with a malicious configuration can therefore cause code execution on the developer’s machine before the model has meaningfully acted. Manifold says fixes shipped for goose, Codex, Cursor and one Claude Code path, while Hermes Agent, Qwen Code, Grok Build and a second Claude Code path remained unpatched when it re-tested current versions on September 1. OpenAI and GitHub advisories independently confirm the same class in Codex and goose.
Why it matters
Agent sandboxes and approval prompts do not protect code paths that occur outside the agent’s explicit tool loop. Developers increasingly treat repository opening, indexing and context gathering as harmless setup, but those steps can invoke legacy tooling with its own executable configuration. That creates a supply-chain path in which merely receiving a project directory with its `.git` metadata intact can be enough to run host commands as the developer, potentially exposing local files, credentials and network access. The fix therefore belongs partly in agent architecture: vendors need to sanitise Git configuration on background calls rather than relying only on model permissions.
The exploit sits below the model layer
Git supports configuration entries such as `core.fsmonitor` whose value can name a command. Several coding agents automatically run Git commands to learn branch and working-tree state. If they pass repository-local configuration through unchanged, Git executes that command on the host even though the model never requested it.
Trust prompts can happen too late
Manifold reports that some affected paths fire before the workspace-trust prompt, before authentication or on the first keystroke. That matters because the visible agent permission model has not yet had a chance to intervene.
The delivery path is narrower than an ordinary clone
The malicious `.git/config` has to arrive with the repository metadata intact, such as through an archive, shared drive, synced folder or removable media. A normal remote `git clone` does not copy another repository’s local `.git/config`, so the research does not imply every public repository can trigger the flaw through a conventional clone.
Multiple vendors independently hit the same plumbing problem
Manifold found the pattern across Claude Code, Codex, Cursor, goose, Hermes Agent, Qwen Code and Grok Build. Five reports were duplicates of findings other researchers had already submitted, suggesting the issue is a recurring architectural hazard rather than one implementation mistake.
The practical mitigation is to distrust executable Git config during agent setup
For agent vendors, background Git calls should explicitly neutralise executable configuration such as `core.fsmonitor`. For users handling project directories received as files, inspecting `.git/config` before opening the directory in an agent narrows the immediate risk.