On September 2, security firm Manifold Security disclosed a class of vulnerabilities named GitSpawn: eight findings across seven AI coding agents — including Claude Code, Codex and Cursor — that let a malicious Git repository run arbitrary commands without the user approving anything.
The problem isn't the model — it's the "plumbing" around the agent. Nearly every coding agent runs background Git commands, like git status or git diff, to gather project context before answering. That process refreshes Git's internal index, which in turn can invoke core.fsmonitor, a legitimate performance option that lets a repository specify a helper program Git runs automatically every time the index updates.
If that repository arrives as plain files with the .git directory intact — say, in a shared ZIP, a network drive, a synced folder, or a USB stick, rather than through a normal clone — the command defined in core.fsmonitor executes with the user's permissions, outside the agent's sandbox and without any approval prompt.
According to Manifold, goose, Claude Code (on its primary path) and Cursor have already received patches. OpenAI issued three CVEs for Codex, including CVE-2026-19592. As of September 1, however, Hermes Agent, Qwen Code, Grok Build and a second Claude Code code path were still executing repository-controlled commands with no fix available.
Manifold recommends two immediate steps: manually inspect .git/config before opening any repository received as loose files (not cloned) in an agent, and disable core.fsmonitor by default with git config --global core.fsmonitor false. For teams managing developer fleets, auditing the global configuration with git config --global --list | grep fsmonitor is a low-cost first step.
GitSpawn confirms a pattern already seen in other agent flaws throughout 2026: the risk isn't always in the model — it's in the set of commands the agent runs "on your behalf" before the user ever sees a single response. Any company that distributes coding agents to its development team should treat the receipt of third-party repositories — via ZIP, shared drives, or external contractors — as a real attack surface, not just the prompt the developer types.
core.fsmonitor as a global policy across development machines, and make it standard practice that no third-party repository gets opened in an agent without first going through a clean clone.
Carlos Montiel is an enterprise AI solutions architect. He implements LLMs, Agents, RAG and orchestrators for companies across Guatemala and Latin America. Reach out for a consultation.
Contact Carlos Montiel