Security researchers at Manifold Security have disclosed eight vulnerabilities — collectively named GitSpawn — affecting seven AI coding agents, including Claude Code, Cursor, OpenAI Codex, Grok Build, Qwen Code, Hermes Agent, and goose. Each flaw uses the same mechanism: Git’s core.fsmonitor setting, a performance feature whose value is a shell command that Git runs to detect file changes. Agents that invoke git status or git diff at startup automatically execute whatever command the repository’s own .git/config specifies — before the user is prompted to approve anything, and outside any sandbox the agent runs.
The attack requires no prompt injection and no model exploitation. An attacker simply ships a repository with a weaponized .git/config to a target (via shared archive, USB drive, or synced folder — ordinary git clone strips the file). Once a developer opens the repository in a vulnerable agent, the payload runs as that developer, with full access to their files, credentials, and network. Manifold retested all seven agents on September 1; fixes had shipped for goose, Claude Code (version 2.1.196, released June 29), and Cursor. Hermes Agent, Qwen Code, Grok Build, and a second execution path in Claude Code remained unpatched at that date. OpenAI separately published three CVEs for Codex covering the same class, including CVE-2026-19592 (for a helper that runs outside Codex’s sandbox without user approval). The highest scored finding, CVE-2026-72718 (CVSS 7.0), covers the goose review command.
How to check if you’re affected
Affected versions of Claude Code older than 2.1.196 are vulnerable; update immediately using npm install -g @anthropic-ai/claude-code or your package manager. Affected models of Cursor before the August 2026 patch should prompt you to update on next launch. If you use Hermes Agent, Qwen Code, or Grok Build, treat any repository from an untrusted source as dangerous until a fix is available — do not open it in the agent. As a general precaution on any agent, inspect .git/config in unfamiliar repositories before opening them and verify the core.fsmonitor key is absent.