GitSpawn: AI coding agents run unsanitised git config from untrusted folders
Manifold Security published GitSpawn research on 1 September 2026: several AI coding agents run git (status, diff and similar) to gather repo context at startup, in some products before a workspace-trust prompt or authentication. Those calls did not strip the repository's own git configuration. Git settings that name a helper program (including core.fsmonitor) then run as the developer, outside the agent sandbox, with no approval prompt. Manifold says clone, fetch or pull of a hostile URL does not carry this; the repository has to arrive as files with its .git directory already inside (zip, shared drive, USB). Named products and status at publication: Claude Code core.fsmonitor patched by 2.1.196 (confirmed on 2.1.193; reported 26 June, closed as duplicate); Claude Code ultrareview still unpatched on 2.1.252; Goose patched in 1.44.0 (CVE-2026-72718, maintainers 7.0); Hermes unpatched on 0.21.0 (CVE-2026-71963, VulnCheck CNA); Qwen Code unpatched on 0.22.3; Grok Build unpatched on 1.0.13; OpenAI Codex and Cursor patched (reports closed as duplicates). Manifold 1 September update says Codex and Cursor were also affected, reported, and have since been patched. Inspect .git/config before opening a received folder in an agent. This desk does not invent CVSS for the unpatched products.
- Product
- AI coding agents (Claude Code, Goose, Hermes, Qwen Code, Grok Build, Codex, Cursor)
- Versions
- See summary; several remain unpatched on the builds Manifold re-checked on 1 Sep 2026
- CVSS
- 7.0 (CVE-2026-72718 Goose, maintainers); other CVEs have no desk-assigned score
- Exploited in Australia?
- unknown
- Patch to
- Claude Code 2.1.196+ (fsmonitor path); Goose 1.44.0; Codex and Cursor current patched builds; others: inspect .git/config and wait for vendor fixes
Primary: Manifold Security GitSpawn (1 Sep 2026) · CVE: CVE-2026-72718, CVE-2026-71963 · The Hacker News (2 Sep 2026)