GitSpawn Flaws Let Malicious Repositories Execute Code in Claude Code, Codex, Cursor, and Grok

A newly disclosed class of vulnerabilities, dubbed GitSpawn, allows a booby-trapped repository to silently execute code on a developer’s machine the moment it is opened with an AI coding agent, no prompt typed, no approval clicked, and in some cases before the user has even authenticated.

Security researchers at Manifold Security found the flaw while investigating what CLI-based coding agents actually do on startup, as detailed in the technical disclosure published by Manifold Security.

Nearly every agent they examined gathers project context by quietly running git commands like git status or git diff in the background. That behavior is unremarkable on its own, but each of these commands triggers git to refresh its internal index, and that refresh is where the danger lies.

Git supports a performance setting called core.fsmonitor, which lets a repository specify a helper program that git runs automatically whenever the index refreshes. It is documented intended functionality, but it is read straight out of the repository’s own .git/config file.

That means a malicious repository can embed an arbitrary command in its configuration, and the moment an AI agent runs a routine context-gathering git command inside it, that command executes with the full privileges of the logged-in user, outside the sandbox and completely invisible to any permission system.

The attack cannot be delivered through a normal git clone, fetch, or pull, since those operations never transmit a hostile .git/config, reads the Manifold Security report.

Instead, the poisoned repository has to arrive as files, its .git directory intact, through a zipped folder, a shared drive, a synced directory, or a USB stick, exactly the way colleagues and consultants routinely hand off projects.

Tool / Platform	Vulnerability Mechanism	Severity & Remediation Status
Git Core Configuration	core.fsmonitor hook executed on background index refresh	Arbitrary local command execution outside agent sandboxes
Claude Code	Automatic git context queries and ultrareview key abuse	Four unpatched flaws tracked; 77M+ monthly npm downloads
Goose	Background context-gathering git command triggers	Fixed in latest vendor build; assigned CVE-2026-72718
Hermes Agent	Unsanitized repository startup execution	Vendor unresponsive after six attempts; assigned CVE-2026-71963
Cursor & Codex	Variant repository configuration execution	Both vendors shipped patches following independent discovery
Qwen Code & Grok Build	Startup context-gathering git invocation	Vulnerable to unauthenticated pre-execution file compromise

The research team confirmed the flaw across Claude Code, Goose, Hermes Agent, Qwen Code, and Grok Build, together representing close to half a million GitHub stars and, in Claude Code’s case alone, more than 77 million monthly npm downloads.

OpenAI’s Codex and Cursor were also found to be affected through variants of the same class; both were patched after being reported, though each was flagged as a duplicate of findings other researchers had independently filed.

Of the eight issues tracked, four remain unpatched at publication, including a distinct flaw in Claude Code’s ultrareview command that abuses a different git configuration key rather than core.fsmonitor, deliberately left unnamed to avoid handing attackers a working template.

Goose has already shipped a fix and received CVE-2026-72718, while Hermes was independently assigned CVE-2026-71963 after the vendor failed to respond across six contact attempts.

Developers who receive a repository as raw files rather than through a clone should inspect .git/config before opening it in any AI agent.

Vendors, meanwhile, are being urged to sanitize git configuration during background context-gathering calls, for instance by explicitly disabling core.fsmonitor, to close off this entire class of silent, pre-authentication code execution.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.