Manifold Security published research on September 2 under the name GitSpawn, forcing a closer look at AI coding agents below the model layer: not the prompt, not the assistant’s reasoning, but the Git commands these tools run to understand a project. The finding describes a class of flaws in which a repository received as a folder or archive can carry local Git configuration that causes code to run on a developer’s machine when an agent inspects the directory.

What Manifold found

The research was authored by Francisco Rosales of Manifold Security. According to the primary report, several command-line coding agents ran `git status`, `git diff`, or similar operations during startup or review preparation without neutralizing repository-local settings inside `.git/config`. One of those settings, `core.fsmonitor`, is a legitimate Git feature: it can name an external helper program used to speed up change detection in large repositories. The risk appears when that configuration travels inside an untrusted repository and Git honors it during an index refresh.

In that scenario, the command does not come from a model suggestion and does not pass through the agent’s normal permission layer. Git launches the configured helper with the privileges of the user running the tool. That is why Manifold called it GitSpawn: the agent asks for context, Git refreshes state, and the repository decides what process is spawned.

Affected agents and patch status

Manifold documented eight findings across seven agents: Claude Code, OpenAI Codex, Cursor, Goose, Hermes Agent, Qwen Code, and Grok Build. The Hacker News published a synthesis on September 2 and corroborated the broad timing and scope. Remediation was uneven. Claude Code’s `core.fsmonitor` path was fixed in version 2.1.196; Goose fixed its issue in 1.44.0 and received CVE-2026-72718; Codex and Cursor are also reported as patched.

The unresolved side requires careful wording. In the original disclosure, Manifold said four findings were still live after retesting on September 1: Qwen Code, Grok Build, Hermes Agent, and a second Claude Code path tied to `ultrareview`, whose technical details were withheld. Since then, the Hermes Agent CVE record, CVE-2026-71963, has been published and says versions 0.18.2 through 0.21.0 are affected, with a fix in commit `f6234d0`. For Qwen Code, current search results show hardening commits related to read-only Git commands and repository-local configuration, but this article should be read as a disclosure snapshot, not as a complete audit of every live installation.

The key condition: this is not a normal `git clone` case

The delivery path matters. According to Manifold and The Hacker News, a normal clone of a remote repository does not usually copy the source repository’s local `.git/config`. The main risk is a project received as files with its `.git` directory preserved: a ZIP archive, synced folder, shared drive, USB stick, or third-party handoff. That distinction prevents panic about Git itself, but raises the bar for any project received as files rather than freshly cloned from a trusted remote.

What teams should do

The immediate mitigation is practical: before opening a received folder with an AI coding agent, inspect `.git/config` for settings that name programs, including `core.fsmonitor` and related executable paths. Teams should update agents to fixed versions or commits, run coding agents in containers or disposable machines when code provenance is unclear, and avoid giving the agent process direct access to SSH keys, cloud tokens, or production secrets.

For vendors, the lesson is structural: automatic Git calls should sanitize repository configuration before execution, for example by forcing safe values in the command invocation itself. GitSpawn shows that agent security is not only about model alignment or visible command approval. It also depends on the plumbing that runs before the user is asked anything.

Sources consulted: Manifold Security, The Hacker News, Goose GitHub Security Advisory, CVE-2026-71963/NVD, and public remediation records.

Written by Lía Torres — Social and strategic perspective.