GitSpawn: a single Git setting runs attacker code inside AI coding agents before any trust prompt -- half the affected tools are still exposed

Security researchers at Manifold Security disclosed eight code-execution flaws, collectively called GitSpawn, across seven AI coding agents -- and as of their September 1 retest, four of those findings were still unpatched. The mechanism is almost insultingly simple: a single line in a repository's own `.git/config` file runs attacker-chosen code the moment an agent issues a routine `git status` to figure out where it is, before any workspace-trust prompt, before authentication, before the user has typed a single instruction.

The line is `core.fsmonitor`, a legitimate Git setting that names an external helper program Git can run to speed up status checks on large repositories. Git treats that setting as trustworthy configuration, not attacker input -- so when an agent's startup routine calls `git status` or `git diff` to orient itself in a new folder, and that folder's own `.git/config` names a malicious helper, Git launches it outside the agent's sandbox, with the developer's own file, credential, and network access, and no approval dialog ever appears. OpenAI's own vulnerability record for the flaw in Codex describes the result plainly: the helper "runs outside Codex's command sandbox and without a user-approval prompt, allowing attacker-controlled code to run with the user's privileges."

Manifold reported the eight findings across seven agents between late June and late July, then re-tested all of them on September 1. The results split down the middle. Claude Code, OpenAI's Codex, Cursor, and Goose had shipped fixes. Anthropic's own patch is only partial: Claude Code closed the `core.fsmonitor` path Manifold originally reported, but left a second path -- reached through its own `claude ultrareview` command -- open on the exact build Manifold used to retest.

Manifold's own retest names exact builds. Claude Code's core.fsmonitor path closed in version 2.1.196; Cursor and OpenAI's Codex (CLI 0.131.0, plus Desktop builds numbered 26.519.x) both patched in July; Goose closed its version, tracked as CVE-2026-72718, in release 1.44.0. Hermes Agent's flaw carries its own tracking number, CVE-2026-71963, and remained open on the versions Manifold tested, 0.18.2 and 0.21.0.

The one real mitigating factor is how narrow the delivery path is. An ordinary `git clone` does not carry a source repository's local `.git/config` into the copy it creates -- Git writes a fresh one. GitSpawn only fires when a repository arrives as a raw folder that keeps its original `.git` directory intact. That rules out the most common way developers get code, but not the ways AI agents specifically are already being fed code: a separate campaign disclosed in July, called FakeGit, used roughly 7,600 lookalike GitHub repositories and malicious ZIP archives to get Claude Code, Gemini, and ChatGPT to recommend attacker-controlled downloads to their own users -- exactly the packaging (a raw archive, not a clean clone) that would carry a poisoned `.git/config` intact.

GitSpawn is not the only sandbox-escape research to land on AI coding agents this year, and the two should not be confused for the same bug. Separate research from Cymulate -- first published in April, with a follow-up BleepingComputer covered in July -- found a different vulnerability class, Configuration-Based Sandbox Escape, hitting Claude Code, Gemini CLI, Codex, Cursor, and Antigravity: the agent itself stays inside its sandbox and follows every rule, but writes a file (a hook config, a virtualenv interpreter, a Docker socket call) that a trusted tool outside the sandbox later runs, loads, or scans, typically on the tool's next restart. Different trigger, different fix, same underlying shape: the boundary these tools draw around "the agent" is not the boundary that turns out to matter, because ordinary developer tooling keeps running unsandboxed just outside it -- and GitSpawn is now the third distinct escape class documented against this category of product in 2026, not the first.

For Claude Code specifically, GitSpawn is not a first offense. A researcher demonstrated a different sandbox escape, SharedRoot, in Anthropic's Cowork tool in July; a separate chain reached full remote code execution through a GitHub issue at Black Hat weeks later; and in September a researcher got Auto Mode to run malware in up to 80% of test runs through an unrelated dependency-execution trick. None of the four disclosures share a root cause. What they share is a pattern: a guardrail built to treat a repository's own contents as untrusted keeps getting defeated by something inside that repository the guardrail wasn't watching.

None of this has produced confirmed real-world exploitation yet -- CVE-2026-19592 does not appear in CISA's Known Exploited Vulnerabilities catalog, and Manifold's own writeup stops short of claiming an active campaign. The gap that matters is the one between disclosure and fix: three vendors have gone six or more weeks without a public patch for a report that grants full code execution before a user approves anything, on tools with a combined install base in the tens of millions.