"GitSpawn": A Repository's Own `.git/config` Runs Attacker Commands in Seven AI Coding Agents (CVE-2026-72718, CVE-2026-71963, CVE-2026-55607, CVE-2026-19592)

Claude Code, OpenAI Codex CLI and Desktop, Cursor CLI, goose, Qwen Code, Grok Build, and Hermes Agent

Manifold Security published eight findings across seven command-line AI coding agents on September 1 and 2, 2026. Agents run git commands in the background to work out branch status and changed files, and they do so without stripping the repository's own `.git/config`. Several git settings are command-execution sinks; the one used throughout is `core.fsmonitor`, whose value is a command git runs during index refresh to identify changed files. A repository names a command, git runs it on the host with the user's privileges, outside the agent's sandbox, and before any approval prompt appears. On the vulnerable versions the payload fires ahead of the security gate in every case: Claude Code and Hermes Agent before workspace-trust acceptance, Qwen Code before authentication, Grok Build on the first keystroke. Exploitation requires the repository to arrive as files with its `.git` directory intact, which a shared archive, network drive, sync folder, prebuilt dev container, or USB stick preserves and an ordinary `git clone` does not. Fixes shipped for goose (CVE-2026-72718, patched 1.44.0), Claude Code's `core.fsmonitor` path (fixed in 2.1.196, CVE-2026-55607 covering the worktree case), Cursor CLI, and Codex (CLI fixed in 0.131.0, Desktop in 26.519.22136 on macOS and 26.519.21041 on Windows), with OpenAI publishing three CVEs of its own the same day credited to three unrelated research groups. Still executing repository-supplied commands when Manifold retested on September 1: Hermes Agent (CVE-2026-71963, assigned by VulnCheck after six contact attempts across five channels went unanswered), Qwen Code, Grok Build, and a second path in Claude Code reached through the `claude ultrareview` command on 2.1.252. Five of Manifold's reports were closed as duplicates of independent findings, which indicates parallel discovery. No in-the-wild exploitation was known at publication, though the FakeGit network of roughly 7,600 malicious repositories has been distributing exactly this kind of pre-packaged archive

The agent treats a checked-out repository as data to be read and git as a trusted local tool, but a repository ships its own git configuration and git configuration is executable. The workspace-trust prompt, the sandbox, and the tool-approval classifier are all positioned after the point where the command already ran