Manifold Security published GitSpawn research on 1 September 2026: several AI coding agents run git (status, diff and similar) to gather repo context at startup, in some products before a workspace-trust prompt or authentication. Those calls did not strip the repository's own git configuration. Git settings that name a helper program (including core.fsmonitor) then run as the developer, outside the agent sandbox, with no approval prompt.

Manifold says clone, fetch or pull of a hostile URL does not carry this; the repository has to arrive as files with its .git directory already inside (zip, shared drive, USB). Named products and status at publication: Claude Code core.fsmonitor patched by 2.1.196 (confirmed on 2.1.193; reported 26 June, closed as duplicate); Claude Code ultrareview still unpatched on 2.1.252; Goose patched in 1.44.0 (CVE-2026-72718, maintainers 7.0); Hermes unpatched on 0.21.0 (CVE-2026-71963); Qwen Code unpatched on 0.22.3; Grok Build unpatched on 1.0.13; OpenAI Codex and Cursor patched (reports closed as duplicates).

Manifold 1 September update says Codex and Cursor were also affected, reported, and have since been patched. Inspect .git/config before opening a received folder in an agent. This Cyberstack does not invent CVSS for the unpatched products.

Correction (26 Oct 2026): a reference to the CVE numbering authority for CVE-2026-71963 has been removed. (source: Manifold Security)

Correction (02 Nov 2026): removed The Hacker News as a source. (source: Manifold Security)