A single line in a Git configuration file can now hijack seven of the most widely used AI coding agents on the market. On September 1-2, 2026, security firm Manifold Security disclosed a vulnerability class it calls GitSpawn: eight distinct flaws spread across seven command-line coding agents, including Anthropic’s Claude Code, OpenAI’s Codex, Cursor, Cognition’s Goose, Hermes Agent, Alibaba’s Qwen Code, and xAI’s Grok Build. Four of the eight findings were still unpatched at the moment of publication, according to Manifold’s research and coverage from The Hacker News and the Cloud Security Alliance.
The bug does not touch the language model at all. It lives in the mundane background commands these agents run the instant they open a project, before a developer has typed a single prompt. That distinction matters, because it shows attackers no longer need to trick a model with clever text. They can just hand a developer a folder.
What Is GitSpawn? Inside the New AI Coding Agent Vulnerability
GitSpawn is not one bug. It is a pattern that Manifold Security found repeated, with small variations, across seven different products built by seven different companies. Each AI coding agent in the affected group routinely runs background Git commands, most commonly git status or git diff, the moment it opens a repository. It does this to orient itself: to figure out what branch it’s on, what files changed, and what the project looks like before offering any suggestions.
That routine housekeeping step turns out to be the opening. According to Manifold’s write-up and a Cloud Security Alliance research note on the disclosure, the exploit runs through a legitimate Git performance setting called core.fsmonitor, which names a helper program Git invokes whenever it refreshes its file index. The setting exists to speed up large repositories on developer machines. Nothing about it is inherently malicious. But if an attacker plants a malicious value for core.fsmonitor inside a repository’s own .git/config file, Git will dutifully launch whatever command that value points to, and it will do so automatically, the first time an agent runs a background status check.
The result, per Manifold’s testing and confirmed independently in Cloud Security Alliance briefings, is command execution that happens outside the AI agent’s own sandbox, with the developer’s full local user privileges, and without any tool-approval prompt from the agent’s interface. In other words, the safety UI a developer trusts to flag risky actions never fires, because the agent’s own security layer is not the thing running the command. Git is.
How a Repository’s Own Git Config Becomes a Remote Code Execution Path
One detail limits how GitSpawn spreads, and it is worth understanding before panicking about every repository on a hard drive. The Hacker News’ coverage of the disclosure notes that exploitation requires the repository to arrive as files with its .git directory intact. A shared archive, a shared drive, a sync folder, or a USB stick preserves that directory structure. An ordinary git clone from a remote host does not carry over the malicious local configuration in the same way, because cloning builds a fresh local config rather than copying the attacker’s .git/config wholesale.
That narrows the realistic attack surface to specific handoff scenarios: a contractor sends over a zipped project folder, a team shares code through a synced cloud drive, or an open-source maintainer downloads a “helpful” bug-report archive from a stranger. In each case, if the developer opens that folder in an affected AI coding agent, the agent’s own background Git housekeeping becomes the delivery mechanism for arbitrary code execution, with no click, no approval dialog, and no visible warning.
Checkpoint’s September 7 Threat Intelligence Report grouped GitSpawn with a broader theme it has been tracking for weeks, describing a run of critical vulnerabilities hitting the infrastructure underneath AI agents rather than the models themselves, according to Forkast’s coverage of that pattern. That framing matters for how security teams should prioritize the fix: this is not a prompt-injection problem that better model training will eventually solve. It is a tooling and integration problem that lives in the supply chain of dependencies every agent quietly relies on.
The Eight Findings: Which AI Coding Agents Are Exposed
Manifold’s disclosure and subsequent Cloud Security Alliance briefings put the scope at eight distinct findings across seven products, because Claude Code alone accounts for two separate vulnerable paths. The table below reflects the patch status reported at the time of disclosure on September 1-2, 2026.
| AI Coding Agent | Vendor | Confirmed Vulnerable Versions | Patch Status | CVE / Tracking ID |
|---|---|---|---|---|
| Claude Code (core.fsmonitor path) | Anthropic | 2.1.193 | Patched in 2.1.196 | Not separately assigned in cited coverage |
| Claude Code (claude ultrareview path) | Anthropic | 2.1.252 | Unpatched at disclosure | Not separately assigned in cited coverage |
| Codex CLI & Desktop | OpenAI | 0.102.0 – 0.130.0 | Patched in 0.131.0 (CLI) | CVE-2026-19592 (CVSS 7.3) |
| Cursor | Cursor / Anysphere | Pre-patch builds | Patched (current release) | Not disclosed in cited coverage |
| Goose | Cognition | Prior to 1.44.0 | Patched in 1.44.0 | CVE-2026-72718 |
| Hermes Agent | Not specified in coverage | 0.18.2 and 0.21.0 | Unpatched, fix pending | CVE-2026-71963 per one security-tooling tracker |
| Qwen Code | Alibaba | 0.19.6 and 0.22.3 | Unpatched, fix pending | Not disclosed in cited coverage |
| Grok Build | xAI | Not specified in coverage | Unpatched, fix pending | Not disclosed in cited coverage |
Four vendors shipped fixes for at least one variant before the disclosure went public: Anthropic, OpenAI, the Cursor team, and Cognition’s Goose project. Four variants remained open at publication: the second Claude Code path, plus Hermes Agent, Qwen Code, and Grok Build in full. Manifold reported retesting each agent on September 1 to confirm current status before going public, according to The Hacker News’ summary of the disclosure.
OpenAI Codex and CVE-2026-19592, Explained
The clearest-documented single finding in the GitSpawn set is OpenAI’s, tracked as CVE-2026-19592. The advisory language, as reflected in CVE database entries covering the record, describes Codex automatically collecting Git repository metadata without disabling the repository-local core.fsmonitor setting. Codex CLI versions 0.102.0 through 0.130.0 are listed as affected, alongside pre-patch builds of Codex Desktop for both macOS and Windows, including the Microsoft Store package. The fix landed in CLI version 0.131.0, with corresponding desktop builds patched at specific version thresholds published in the CVE record.
The flaw carries a CVSS 3.1 base score of 7.3, rated High, with a vector indicating local attack complexity, low privileges required, user interaction required, and high impact to confidentiality, integrity, and availability once triggered. Security data platform Mallory.ai reported that OpenAI published three separate CVEs tied to the broader vulnerability class, with CVE-2026-19592 as the headline entry covering the Codex core.fsmonitor sink specifically.
Cybersecurity vendor SentinelOne’s vulnerability database entry for the CVE echoes the same mechanism: the fsmonitor helper runs outside Codex’s command sandbox and without a user-approval prompt, handing an attacker code execution with the full privileges of whoever opened the malicious repository. As of the disclosure window, CVE trackers including Feedly’s dedicated CVE page reported no public proof-of-concept exploit and no confirmed in-the-wild exploitation.
Claude Code’s Two Flaws: One Fixed, One Still Live
Anthropic’s Claude Code shows up twice in Manifold’s tally, because the agent has two separate code paths that reach the vulnerable Git behavior. The Hacker News’ reporting on the disclosure states that Manifold confirmed the core.fsmonitor path as exploitable on Claude Code version 2.1.193, and that Anthropic shipped a fix by version 2.1.196. That is a fast turnaround by vulnerability-disclosure standards, and it puts Anthropic in the patched column for its primary GitSpawn exposure.
The second path is different. Referred to in coverage as the “claude ultrareview” path, this second sink was confirmed live and still exploitable on Claude Code version 2.1.252, according to the same Hacker News summary and matching Cloud Security Alliance briefings dated September 3 and 4. That means a developer running a fully up-to-date Claude Code install past the first patch remained exposed to a second, separately-triggered variant of the same underlying class of flaw. It is a reminder that patching the headline finding in a vulnerability class does not automatically close every door the researchers found.
Cursor, Goose, Hermes Agent, Qwen Code and Grok Build: Where Patches Stand
Cursor and Goose both landed on the patched side of Manifold’s scorecard. Goose’s fix is the most precisely documented of the group: versions before 1.44.0 are listed as vulnerable, with the fix shipping in 1.44.0 and tracked as CVE-2026-72718. Cursor’s patch status is described only as “current” in Cloud Security Alliance guidance, without a specific version number or CVE identifier disclosed in the cited material, though the guidance treats a current Cursor install as safe from the finding Manifold tested.
The remaining three agents were still open at disclosure. Hermes Agent was confirmed vulnerable at versions 0.18.2 and 0.21.0, with a fix described as pending in The Hacker News’ reporting. One third-party security-tooling scorecard lists a tracking identifier of CVE-2026-71963 for that exposure, though this attribution appears in only one of the cited sources. Qwen Code, built by Alibaba, was confirmed vulnerable at versions 0.19.6 and 0.22.3, also with a fix pending as of the disclosure. Grok Build, xAI’s coding agent, appears throughout Cloud Security Alliance briefings as one of the four unpatched findings, though the cited coverage does not supply specific affected version numbers for it.
None of the three vendors behind Hermes Agent, Qwen Code, or Grok Build is quoted issuing a public statement in the sources reviewed for this article. That silence is itself notable next to OpenAI’s detailed CVE advisory and Anthropic’s fast first-path patch.
Why This Attack Bypasses Sandboxes and Approval Prompts
Most AI coding agents built in the last two years sell developers on a specific safety promise: the model proposes an action, a sandbox contains it, and a visible approval prompt gives the human a final veto before anything touches the filesystem or network. GitSpawn slides underneath all three layers at once.
The command never comes from the model. It comes from Git itself, reacting to a configuration file the agent trusts implicitly because it is part of the standard toolchain every developer already uses. The agent’s sandbox exists to contain what the AI decides to do. It was not designed to contain what a third-party binary like Git decides to do on the agent’s behalf during routine housekeeping. And because the fsmonitor helper fires during a background status check rather than a user-initiated action, there is no natural moment in the interface for an approval dialog to appear. By the time a developer sees any output at all, the attacker’s command has already run.
That is the structural reason GitSpawn drew attention beyond the usual patch-and-move-on cycle. It demonstrates that an agent’s stated security model can be technically accurate and still miss an entire class of execution paths that route through trusted dependencies rather than the AI’s own decision-making.
GitSpawn Fits a Pattern: September’s Run of AI Agent Infrastructure CVEs
GitSpawn did not land in isolation. It arrived in the middle of a cluster of critical disclosures hitting the plumbing underneath AI agents rather than the models they run on, a pattern Forkast’s coverage explicitly linked together under the framing that AI inference infrastructure had become a regular target. The table below lines up the disclosures from the same early-September window.
| Vulnerability | Affected System | CVE | CVSS Score | Disclosed |
|---|---|---|---|---|
| GitSpawn (Codex path) | OpenAI Codex CLI & Desktop | CVE-2026-19592 | 7.3 (High) | Sept 1-2, 2026 |
| GitSpawn (Goose path) | Cognition Goose | CVE-2026-72718 | ~7.0 | Sept 1-2, 2026 |
| DeepSeek Harness sandbox escape | Open-source AI coding-agent runtime | CVE-2026-82533 | 9.4 (Critical) | Sept 8, 2026 |
| IBM Langflow unauthenticated RCE | LLM/agent workflow builder | CVE-2026-81204 | 9.8 (Critical) | Sept 8, 2026 |
| AutoAgent TCP server exposure | AI agent orchestration tool | CVE-2026-86124 | 9.8 (Critical) | Sept 11, 2026 |
The DeepSeek Harness flaw, an open-source AI coding-agent runtime that had gathered roughly 215,000 GitHub stars since its August 2026 release, let a sandboxed agent escape confinement entirely because the harness’s authentication check trusted a client-supplied HTTP Host header instead of the real connection origin, according to Cloud Security Alliance research notes. IBM’s Langflow, used to build and run LLM and agent workflows, drew a 9.8 CVSS score for allowing unauthenticated remote code execution during graph construction. AutoAgent’s flaw was blunter still: its TCP server shipped with authentication effectively switched off, letting anyone who could reach it execute commands as root.
Compared against that backdrop, GitSpawn’s 7.3 CVSS score for the Codex finding looks almost modest. But its reach across seven independently-built products from seven different companies is unusual. Most CVEs in this cluster hit a single open-source project or a single vendor’s platform. GitSpawn is closer to a class-wide design flaw that multiple engineering teams converged on independently, because they all built the same “run git status on startup” convenience feature without thinking through what a hostile .git/config could do with it.
Historical Context: From Prompt Injection to Supply-Chain Git Configs
Security researchers spent most of 2025 and early 2026 focused on prompt injection as the dominant AI agent risk, the technique where malicious text embedded in a webpage, document, or email steers a model into taking unwanted actions. OWASP ranked prompt injection as the top LLM risk in its 2025 guidance, and a string of disclosures through the first half of 2026, including an indirect prompt-injection attack that compromised six AI-powered browsers and extensions in June 2026, kept that framing dominant in security coverage.
GitSpawn represents a different failure mode entirely. Manifold’s own framing of the bug, paraphrased from its research write-up, places the flaw not in the model or in anything conceptually new, but in the ordinary background process every agent spawns at session startup just to figure out where it is. That is a supply-chain and integration problem, closer in spirit to a dependency-confusion attack than to a jailbreak. It suggests that as AI coding agents matured from chat interfaces into tools that actively touch a developer’s filesystem and shell, the attack surface quietly expanded to include every piece of tooling those agents lean on without a second thought, Git chief among them.
That shift mirrors a broader trend in AI agent security this year: agents hijacked through poisoned dependency packages and compromised registries, underscoring that an agent’s blast radius now extends to every tool, package, and configuration file it touches on a developer’s behalf.
Market Impact: What GitSpawn Means for Enterprise AI Coding Tools
AI coding agents have moved from novelty to default developer tooling at a striking pace through 2026, with vendors racing to add autonomous, multi-step “agentic” modes that touch source code, run shell commands, and manage Git operations with less human review at each step. GitSpawn arrives as a check on that momentum. Enterprise security teams evaluating which coding agent to standardize on now have a documented, cross-vendor case study showing that agentic convenience features, run automatically and invisibly, can open remote code execution paths that sandboxing and approval prompts were specifically designed to prevent.
For vendors, the disclosure creates a competitive wrinkle. Anthropic, OpenAI, and Cognition’s Goose can point to fast, documented patches for their primary exposure. Cursor’s fix, while shipped, is less precisely documented in public coverage, which may prompt customers to ask for a formal advisory. Alibaba’s Qwen Code, xAI’s Grok Build, and Hermes Agent face a harder conversation: procurement teams doing security reviews will ask directly when a fix is coming, and “fix pending” is not a comfortable answer to give an enterprise buyer.
The episode also strengthens the case for a category of tooling that barely existed two years ago: dedicated security scanning built specifically for AI agent runtimes and their toolchains, rather than generic application security scanners retrofitted to cover agents. Expect that category to see renewed enterprise budget in the wake of this disclosure.
Competitive Comparison: How the Seven Agents Differ on Security Posture
Lined up against each other, the seven affected agents split into three rough tiers based on how they handled this specific disclosure. Anthropic’s Claude Code and OpenAI’s Codex sit in the strongest tier: both shipped documented patches for their primary finding quickly, and OpenAI went further by publishing a full CVE record with version thresholds and a CVSS score, giving security teams exactly the detail they need to verify remediation. Cursor and Goose form a middle tier, patched but with less granular public documentation in the sources reviewed, Goose being the exception with a clean CVE-2026-72718 record.
Hermes Agent, Qwen Code, and Grok Build make up the weakest tier by this measure, not because their engineering is necessarily worse, but because at the disclosure window they had not shipped a fix or issued a public statement. That gap matters for buyers weighing agent vendors on incident response speed, a criterion that carries more weight with every disclosure like this one.
Patch speed is not the same as underlying safety architecture. Claude Code’s second unpatched path is a useful caution against reading any vendor’s fast initial response as proof the whole product is now clean, since this class of bug can recur inside a single codebase even after a highly visible fix.
How to Check If You’re Exposed and Patch Today
Developers and security teams can take concrete steps immediately, drawn from mitigation guidance published alongside the disclosure by Cloud Security Alliance and echoed in CVE advisory language for the Codex finding.
- Before opening any repository received as a ZIP file, shared drive copy, synced folder, or USB transfer, inspect its
.git/configfile for acore.fsmonitorentry naming an external program, and treat any match as a live, already-primed command. - Update Claude Code to at least 2.1.196 for the core.fsmonitor path, and treat the separate “claude ultrareview” path as unresolved until Anthropic confirms a fix.
- Update Codex CLI to 0.131.0 or later, and confirm Codex Desktop is at or above the patch thresholds published in CVE-2026-19592.
- Update Goose to 1.44.0 or later, and confirm Cursor is running its current release.
- Until fixes ship, avoid opening repositories of uncertain provenance in Hermes Agent, Qwen Code, or Grok Build, or restrict those agents to repositories cloned fresh from a trusted remote rather than copied as files.
- Set a global override with
git config --global core.fsmonitor falseas a blanket defense while patches roll out across a fleet of developer machines.
# Check whether a repo's local config sets a suspicious fsmonitor helper
git config --get core.fsmonitor
# Disable fsmonitor globally until every AI coding agent on your machine is patched
git config --global core.fsmonitor falseBecause cloning from a trusted remote does not carry over an attacker’s local .git/config, the single highest-leverage habit change for a development team is simple: stop accepting repositories as raw file copies, and insist on a fresh git clone from a known-good remote instead.
What Comes Next: 5 Predictions for AI Coding Agent Security
GitSpawn is unlikely to be the last disclosure of its kind. Based on the pattern of this month’s cluster of agent-infrastructure CVEs and how vendors have responded so far, several developments look likely in the coming months.
- More vendors patch under pressure. Expect Hermes Agent, Qwen Code, and Grok Build to ship fixes within weeks rather than months, given the public visibility of the disclosure and the competitive cost of remaining the last unpatched name on a widely-cited scorecard.
- Researchers audit other “convenience” background commands. GitSpawn targeted
git status. Expect follow-on research into other automatic background operations agents run at startup, including package manager checks, linters, and language-server initializations, as the next likely home for a similar class of bug. - Enterprise procurement adds an agent-specific security questionnaire. Buyers evaluating AI coding agents will increasingly ask vendors directly about sandbox boundaries for third-party subprocesses, not just for the model’s own tool calls.
- A dedicated AI-agent security tooling category grows. Expect increased enterprise spending on scanners and runtime monitors purpose-built for agent toolchains, separate from traditional static analysis or dependency scanning.
- Git itself faces scrutiny over fsmonitor’s default trust model. Because the underlying
core.fsmonitorfeature is legitimate and widely used outside AI agents too, expect discussion within the Git maintainer community about whether repository-local fsmonitor configuration should require explicit opt-in rather than silent trust.
The Bigger Picture for Developers Using AI Coding Agents
The takeaway from GitSpawn is not that AI coding agents are uniquely dangerous. It is that the security model developers have been sold, a sandboxed AI proposing actions that a human approves, has a blind spot anywhere the agent leans on external tooling that runs outside that loop. Git is about as trusted a piece of developer tooling as exists, which is exactly why a flaw hiding inside its configuration format went unnoticed across seven independently-built products until one research team went looking.
That same trust-by-default pattern shows up elsewhere in the AI agent ecosystem, from compromised package registries feeding malicious code into AI agent pipelines to infrastructure-layer bugs in the tools that host and orchestrate agent workflows. Anthropic’s own decision to pause parts of its agentic security testing program after partner firms were breached earlier this year reflects the same underlying tension: agentic tools are only as safe as every dependency they silently trust. Broader research into the cost and frequency of agentic AI security incidents and the rise of unsanctioned AI tools inside enterprise environments both point the same direction, toward integration points as the emerging center of gravity for AI agent risk, more so than the models themselves.
For now, the practical fix is available and specific: patch the four agents with fixes, treat the three without fixes as high-risk for untrusted repositories, and stop accepting code as raw file copies instead of fresh clones. For the underlying pattern GitSpawn exposed, the fix is going to take longer, and it will likely require every vendor building an AI coding agent to audit every background command their product runs before a human ever sees a prompt.
Frequently Asked Questions
What is GitSpawn?
GitSpawn is a vulnerability class disclosed by Manifold Security on September 1-2, 2026, covering eight distinct flaws across seven AI coding agents. It lets a malicious repository’s own .git/config file, through the core.fsmonitor setting, run an attacker-chosen command automatically when the agent performs a routine background Git operation.
Which AI coding agents are affected by GitSpawn?
Claude Code, OpenAI Codex (CLI and Desktop), Cursor, Goose, Hermes Agent, Qwen Code, and Grok Build are all named in Manifold Security’s disclosure and subsequent Cloud Security Alliance and The Hacker News coverage.
Is OpenAI Codex’s GitSpawn flaw, CVE-2026-19592, fixed?
Yes. Codex CLI versions 0.102.0 through 0.130.0 were affected, with the fix shipping in version 0.131.0. Codex Desktop for macOS and Windows, including the Microsoft Store package, was patched at specific version thresholds published in the CVE record.
Is Claude Code safe to use now that it’s patched?
Partially. Anthropic patched the core.fsmonitor path in Claude Code version 2.1.196. However, a separate path referred to as “claude ultrareview” was still confirmed exploitable on version 2.1.252 as of the disclosure, so updating alone does not close every GitSpawn-related exposure in Claude Code.
Do I need to worry about GitSpawn if I only use git clone?
Your risk is significantly lower. Coverage of the disclosure notes that exploitation requires a repository to arrive as files with its .git directory intact, which a ZIP archive, shared drive, sync folder, or USB copy preserves. An ordinary git clone from a remote does not carry over the attacker’s malicious local configuration in the same way.
Which AI coding agents are still unpatched?
As of the disclosure window, Hermes Agent, Qwen Code, and Grok Build had not shipped fixes, and a second Claude Code path also remained open. Check each vendor’s release notes directly for the latest patch status before opening untrusted repositories.
How do I check if a repository is trying to exploit this flaw?
Run git config --get core.fsmonitor inside the repository before opening it in an AI coding agent. Any value naming an external program should be treated as a live command rather than a harmless setting.
Has GitSpawn been exploited in the wild?
As of the disclosure window, CVE tracking sources including Feedly’s dedicated CVE page reported no public proof-of-concept exploit and no confirmed in-the-wild exploitation of CVE-2026-19592 or the broader GitSpawn class.
