GitSpawn: Hardening AI Coding Agents Against Git Config RCE

On 1 September 2026, Manifold Security published GitSpawn: a repository’s own .git/config can name a program through core.fsmonitor, and several AI coding agents trigger it when they run a background git status to gather context. According to Manifold, the command runs with your privileges, outside the agent’s sandbox and, in some tools, before any trust or login prompt.

Six weeks later the picture is uneven: Codex, Goose and Hermes have fixes you can verify in public records, Qwen Code merged one on 12 September, and for Claude Code, Cursor and Grok Build the public trail is thin. Here is what is confirmed, what is not, and the week of work I would run.

1. Context: What Manifold Found and What Is Independently Confirmed

Manifold documented eight findings across seven agents. The common thread is not a model or a prompt: it is Git. core.fsmonitor is a documented setting whose value is the path of a hook command that Git runs to learn which files changed, and Git reads it from the repository’s own .git/config. Any command that refreshes the index, such as git status or git diff, can therefore execute whatever that value names. Agents run those commands on their own to build context, often before you type a prompt. Manifold says the payload fires before the workspace-trust prompt in Claude Code, before authentication in Qwen Code and on the first keystroke in Grok Build. For Goose, the advisory confirms the command runs before any model call, prompt or tool approval.

Timeline from public records (2026)

14 MayOpenAI merges openai/codex#22652, ‘ignore fsmonitor config in Git metadata reads’, months before the public disclosure.

29 JunClaude Code 2.1.196 ships (2.1.193 was 25 Jun). According to Manifold it holds the core.fsmonitor fix; the public changelog does not mention it.

24 JulGoose 1.44.0 (23 Jul) and advisory GHSA-r5pp-p5r8-466r (24 Jul). CVE-2026-72718 is published on 10 Aug.

1 SepManifold publishes GitSpawn. OpenAI publishes CVE-2026-19592 the same day.

2 SepHermes merges its fix (PR #101483). VulnCheck publishes CVE-2026-71963 on 3 Sep; tag v0.21.1 (7 Sep) contains the commit.

12 SepQwen Code merges PR #11669 into main. I could not tie it to a tagged release.

8 OctHermes v0.21.6 closes a further class: filter programs defined by an untrusted repository’s config.

Git is behaving as documented, and there is no recipe here

Repository-local config is trusted configuration by design; the failure is agents invoking git on a folder they did not create without neutralising it. I have not reproduced this, and I am deliberately not publishing a payload: everything below comes from public advisories, commits and changelogs linked at the end.

The delivery condition is what defines your real exposure. A source repository’s .git/config does not travel with git clone, fetch or pull, which both Codex’s CVE record and the Hermes pull request state. It travels when the .git directory does: a zipped project, a shared or synced drive, a USB stick, a contractor handoff, a take-home test. That is the folder somebody gave you, not the repo you cloned.

2. Four Implications for Developers Using Coding Agents

These are the four consequences that change how I would open a project today, ordered by how often they will matter in a normal week.

🚦

Approval prompts are not the first gate

Order of operations · Goose advisory, Manifold

Background context gathering can run before you approve anything. Goose’s advisory is explicit that the command runs before any model call, prompt or tool approval; Manifold reports the same ordering for Claude Code, Qwen Code and Grok Build. A dialog you have not seen yet cannot protect you.

📦

Your intake channel is the attack surface

Archives and handoffs · Not git clone

Freelancers, agencies, rescue engagements, take-home tests and bug-report repros all arrive as folders. If the .git directory came along, its config is now yours to trust. Clone from the remote you trust instead of opening the received copy.

🧱

Tool sandboxes do not cover it

Outside the sandbox · Goose advisory

The spawned git process runs on the host with your privileges, outside the agent’s sandbox and permission model. Isolation has to wrap the whole agent: a disposable VM or container, not just a restricted shell tool.

🔑

Secrets ride along

Inherited environment · Hermes, Goose

The process inherits the agent’s environment, and both the Hermes and Goose records name provider API keys as reachable. Scoped, short-lived tokens turn a bad day into a contained one.

Triage a folder you received as files

Read-only checks first, then a hardened call for tooling you control. The grep and ls commands only read text; nothing here executes the repository.

# 1. Read the config as plain text before any agent or IDE opens the folder
grep -nEi 'fsmonitor|hookspath|pager|editor|sshcommand|helper|textconv|external|program|smudge|clean|process|driver|include' .git/config
# PowerShell: Select-String -Path .git\config -Pattern 'fsmonitor|hookspath|pager|helper|textconv|smudge|include'

# 2. Non-sample hooks, extra config files, attribute-bound drivers
ls -la .git/hooks | grep -v '\.sample$'
ls .git/config.worktree .git/modules 2>/dev/null
grep -nE 'diff=|filter=|merge=' .gitattributes 2>/dev/null

# 3. Anything naming a program you do not recognise: do not run it.
#    Re-clone from the trusted remote, or copy the files without .git.

# 4. Scripts, CI and in-house agents: neutralise config on automatic calls
git -c core.fsmonitor=false -c core.hooksPath=/dev/null \
    --no-optional-locks status --porcelain
git -c core.fsmonitor=false diff --no-ext-diff --no-textconv

Patched is not the same as closed

Hermes shipped its fsmonitor fix in v0.21.1 and a second fix for repository filter programs in v0.21.6. Qwen Code’s maintainers describe the set of command-running config keys as an open entrance set (issue #10561), and their fix PR lists paths it leaves unguarded. GitHub’s Copilot CLI had a sibling advisory in May (CVE-2026-45033: a nested bare repository reaching core.fsmonitor, fixed in 1.0.43). Count every update as less exposure, not the end of the class.

3. What to Do This Week

No project plan needed. Five working days, in this order:

☀️ Days 1–2: Inventory and update

1. List every coding agent and CLI wrapper on developer laptops and CI runners, with the version each one reports.
2. Compare against the fixed versions I could verify: Codex CLI 0.131.0+ (Desktop 26.519.x builds), Goose 1.44.0+ and Hermes Agent 0.21.1+ (tag v2026.9.7). Claude Code 2.1.196+ rests on Manifold alone.
3. Update everything else to the newest release anyway, and treat Qwen Code, Grok Build and Cursor as unconfirmed until your vendor says otherwise.

📅 Days 3–4: Inspect and harden

Intake rule: any project that arrives as an archive, drive or sync folder is untrusted until its .git is read as text. Prefer a fresh clone or a copy without .git.
Git calls you own: use the flag set above (fsmonitor off, hooks path to /dev/null, no ext-diff or textconv). It mirrors what the Hermes and Qwen Code fixes do; expect slower git status on huge repos that rely on a real fsmonitor.
Environment: strip long-lived keys from the shell that launches the agent and use scoped, short-lived tokens.

📆 Day 5: Isolate and ask your vendor

Isolation: open untrusted folders only in a disposable VM or container with no credentials mounted.
Ask about scope: do you neutralise repo-local config on every automatic git call, by allow-list or deny-list, and which sinks beyond core.fsmonitor are covered (hooks path, diff and textconv drivers, filters, credential helpers, pagers)?
Ask about timing: can any git call run before the trust prompt or authentication, and is there a regression test proving it stays closed?
Ask for the record: which advisory or CVE tracks this, and which exact version fixed it?

4. Where Each Vendor Stands (Checked 14 October 2026)

‘Confirmed’ below means I found a record other than Manifold’s own post: a CVE or advisory, a merged commit, or a release note. Everything else is worded ‘according to Manifold’.

🟢

Codex (OpenAI)

Fixed and confirmed. CVE-2026-19592, published 1 Sep 2026 by OpenAI as CNA (CVSS 7.3 High, secondary score from CISA ADP). Affected: CLI 0.102.0 to 0.130.0; fixed in CLI 0.131.0 and Desktop 26.519.x builds. Fix PR openai/codex#22652 merged 14 May 2026.

🟢

Goose

Fixed and confirmed. CVE-2026-72718 / GHSA-r5pp-p5r8-466r, CVSS v4 7.0 High: goose review ran git without stripping repository config. Affected: versions before 1.44.0; fixed in 1.44.0 (released 23 Jul 2026).

🟢

Hermes Agent

Fixed in code. CVE-2026-71963 (VulnCheck, CVSS v4 8.6 High) covers 0.18.2 to 0.21.0. Commit f6234d0 (PR #101483, 2 Sep) is contained in tag v2026.9.7 (v0.21.1) and later; v0.21.6 (8 Oct) also closes repository filter programs. Manifold’s ‘unpatched’ refers to 0.21.0 on 1 Sep.

🟡

Qwen Code

Partial. According to Manifold: unpatched on 0.22.3 on 1 Sep. PR #11669 (‘guard internal git calls against configured helper programs’) merged into main on 12 Sep, and its description lists paths left unguarded. No tagged release or advisory confirmed; latest release v0.25.1 (11 Oct). Update and verify.

🟡

Claude Code

According to Manifold: the core.fsmonitor path was confirmed on 2.1.193 and fixed by 2.1.196; a separate /ultrareview path was unpatched on 2.1.252 on 1 Sep. Anthropic’s public changelog for 2.1.196 (29 Jun 2026) lists no git-config hardening, and I found no GHSA for this issue. Latest listed: 2.1.300 (14 Oct).

⚪

Cursor

According to Manifold: affected, reported 8 Jul, closed as a duplicate and patched. I found no version number and no public advisory for this item.

🔴

Grok Build

According to Manifold: unpatched on 1.0.13, closed as a duplicate of a 1 Jul report. The truncated release summaries I could see through v1.0.52 (11 Oct) do not name a fix. Status unconfirmed; plan as if it were still exposed.

What I could not confirm

Three points rest on Manifold alone: the Claude Code 2.1.196 fix, the Cursor fix, and the existence and status of the separate /ultrareview issue. Manifold’s statuses for Qwen Code, Grok Build and Hermes date from 1 September and may have moved. I found no report of exploitation in the wild. Re-check your vendor’s advisory page before acting on this list.

Golden rule

Treat repo-local Git config like a shell script from a stranger: read it before anything executes it, and assume an agent that cannot explain how it sanitises Git does not.

Conclusion

GitSpawn is less a single bug than a reminder: coding agents run Git as you, on folders you did not write, before you have said yes to anything. The vendors with public records (Codex, Goose, Hermes) have closed their instances; others have a thin trail, and the class is wider than one config key.

Do the five-day pass above. It costs a week, and it makes you the person on the team who reads .git/config before pressing enter.

This week in one screen

Update

• Codex CLI 0.131.0+
• Goose 1.44.0+
• Hermes 0.21.1+

Inspect

• Read .git/config as text
• Check hooks and attributes
• Re-clone from the remote

Isolate

• Disposable VM or container
• No long-lived keys in env
• Ask vendors for proof

GitSpawn: How a Git Config File Runs Code in Your AI Coding Agent