# GitSpawn shows how a repository’s own Git config can escape AI coding-agent safety boundaries Manifold Security found the same Git configuration execution pattern across seven command-line coding agents. A booby-trapped repository can make background Git context-gathering run attacker-controlled commands on the host, outside the model’s tool sandbox and in several products before trust or authentication checks. The useful lesson is architectural rather than vendor-specific: coding agents inherit execution paths from ordinary developer tooling. If an agent shells out to Git without sanitising repository-local configuration, a hidden `.git/config` can become a host-level command channel that bypasses the controls users think govern the model. - Status: Active - Published: 2026-09-14T20:14:50+12:00 - Updated: 2026-09-14T20:14:50+12:00 - Categories: Artificial Intelligence, Web Development, AI Agents, AI Coding, Developer Tools - Tags: AI agents, Coding agents, cybersecurity, GitSpawn, sandboxing, supply chain security - Canonical HTML: https://beyondthe.news/dossiers/gitspawn-git-config-ai-coding-agent-command-execution ## What changed Manifold Security disclosed eight findings across seven command-line AI coding agents under the name GitSpawn. The shared failure mode is ordinary Git context gathering: agents call commands such as `git status` or `git diff`, and Git honours executable settings from the repository’s own `.git/config`. A received repository with a malicious configuration can therefore cause code execution on the developer’s machine before the model has meaningfully acted. Manifold says fixes shipped for goose, Codex, Cursor and one Claude Code path, while Hermes Agent, Qwen Code, Grok Build and a second Claude Code path remained unpatched when it re-tested current versions on September 1. OpenAI and GitHub advisories independently confirm the same class in Codex and goose. ## Why it matters Agent sandboxes and approval prompts do not protect code paths that occur outside the agent’s explicit tool loop. Developers increasingly treat repository opening, indexing and context gathering as harmless setup, but those steps can invoke legacy tooling with its own executable configuration. That creates a supply-chain path in which merely receiving a project directory with its `.git` metadata intact can be enough to run host commands as the developer, potentially exposing local files, credentials and network access. The fix therefore belongs partly in agent architecture: vendors need to sanitise Git configuration on background calls rather than relying only on model permissions. ## The exploit sits below the model layer Git supports configuration entries such as `core.fsmonitor` whose value can name a command. Several coding agents automatically run Git commands to learn branch and working-tree state. If they pass repository-local configuration through unchanged, Git executes that command on the host even though the model never requested it. ## Trust prompts can happen too late Manifold reports that some affected paths fire before the workspace-trust prompt, before authentication or on the first keystroke. That matters because the visible agent permission model has not yet had a chance to intervene. ## The delivery path is narrower than an ordinary clone The malicious `.git/config` has to arrive with the repository metadata intact, such as through an archive, shared drive, synced folder or removable media. A normal remote `git clone` does not copy another repository’s local `.git/config`, so the research does not imply every public repository can trigger the flaw through a conventional clone. ## Multiple vendors independently hit the same plumbing problem Manifold found the pattern across Claude Code, Codex, Cursor, goose, Hermes Agent, Qwen Code and Grok Build. Five reports were duplicates of findings other researchers had already submitted, suggesting the issue is a recurring architectural hazard rather than one implementation mistake. ## The practical mitigation is to distrust executable Git config during agent setup For agent vendors, background Git calls should explicitly neutralise executable configuration such as `core.fsmonitor`. For users handling project directories received as files, inspecting `.git/config` before opening the directory in an agent narrows the immediate risk. ## Key details - Manifold disclosed eight findings across seven CLI coding agents on September 1, 2026. - The common sink is repository-local Git configuration that names executable commands during automatic Git context gathering. - Commands can execute as the logged-in user, outside the agent sandbox and without a model tool-approval prompt. - goose versions before 1.44.0 were affected; GitHub published GHSA-r5pp-p5r8-466r and CVE-2026-72718 for that path. - Codex CLI 0.102.0 through 0.130.0 was reported affected and fixed in 0.131.0; Codex desktop builds also received fixes. - Claude Code fixed the `core.fsmonitor` path by 2.1.196, while Manifold reported a second review-path issue still live on 2.1.252 as of September 1. - Hermes Agent 0.21.0, Qwen Code 0.22.3 and Grok Build 1.0.13 were reported still affected when Manifold re-tested them on September 1. - The malicious repository generally needs to arrive with its `.git` directory intact; a standard clone does not transport another repository’s local `.git/config`. - No exploitation in the wild was established in the cited research at publication. ## Builder takeaways - Do not assume an agent’s sandbox covers background subprocesses the product launches for context gathering. - Treat project directories received as archives, shared folders or synced workspaces as more dangerous than a fresh clone because they can carry local `.git` metadata. - Update affected coding-agent clients and avoid pinning older versions with known GitSpawn-class fixes missing. - Inspect unfamiliar `.git/config` files for executable Git settings before opening those projects in an AI coding agent. - Agent vendors should run context-gathering Git commands with dangerous repository-local execution hooks explicitly disabled. - Security reviews of coding agents should include their pre-model startup path, repository discovery and ordinary developer-tool subprocesses, not only model tool permissions. ## What to watch - Whether Hermes Agent, Qwen Code, Grok Build and the second Claude Code path receive confirmed fixes. - Whether vendors generalise the patch beyond `core.fsmonitor` to other Git configuration entries capable of launching processes. - Whether coding-agent security guidance begins treating pre-model repository inspection as a formal trust boundary. - Any evidence of real-world exploitation through project archives, synced repositories or shared development volumes. ## Uncertainties - Manifold deliberately withheld the exact Git key for the still-unpatched second Claude Code path. - Version status can change quickly; affected-version statements reflect the researchers’ September 1 re-tests and published advisories. - The attack requires repository-local Git metadata to be present, so risk depends strongly on how the project directory was obtained. - No cited source established exploitation in the wild at publication. ## Timeline - **2026-06-26 — Claude Code fsmonitor path reported:** Manifold reports the `core.fsmonitor` execution path; it says the issue was a duplicate of another report filed the same day. - **2026-06-29 — Claude Code ships a fix for one path:** Manifold says the `core.fsmonitor` path is fixed by Claude Code 2.1.196. - **2026-07-24 — goose advisory is published:** The goose project publishes GHSA-r5pp-p5r8-466r covering arbitrary command execution through `goose review` and Git fsmonitor. - **2026-09-01 — Manifold publishes GitSpawn:** The researchers disclose the cross-agent pattern after re-testing current releases; four of eight findings remain unpatched in their tests. - **2026-09-02 — Wider security reporting follows:** Independent security reporting summarises the cross-vendor findings and OpenAI’s related Codex CVEs. ## Sources - [GitSpawn: A Single Flaw Lets Untrusted Repos Run Code in Claude Code, Codex, Cursor, and Grok](https://www.manifold.security/blog/ai-coding-agents-git-hijack) — Manifold Security · primary security research · 2026-09-01T00:00:00+12:00. Primary cross-agent research, affected versions, patch status and mitigation guidance. - [Arbitrary command execution in goose CLI via goose review via git core.fsmonitor](https://github.com/aaif-goose/goose/security/advisories/GHSA-r5pp-p5r8-466r) — GitHub / goose · primary security advisory · 2026-07-24T00:00:00+12:00. Project advisory confirming the underlying Git configuration execution class and patched goose version. - [Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code](https://thehackernews.com/2026/09/malicious-git-configs-can-make-claude.html) — The Hacker News · independent security reporting · 2026-09-02T00:00:00+12:00. Independent synthesis with affected-version and vendor-response checks, including Codex CVEs and remaining unpatched paths.