On 1 September, researchers at Manifold Security published findings that put every developer using an AI coding tool in a position they were not in last month: their agent can be hijacked by a single line in a git configuration file that lives inside a repository.
A developer opens a folder in Claude Code, Cursor, or Codex. The agent runs git status in the background to gather context—sometimes before the developer has typed anything. The repository's own .git/config file executes arbitrary code on the developer's machine. The agent never shows a trust prompt. The developer never approves anything. The attacker now has their SSH keys, cloud credentials, and every token that lives in the environment.
This is called GitSpawn, and eight findings across seven different AI coding agents were disclosed on the same day. Four of those findings remain unpatched.
Key Takeaways
- Eight GitSpawn vulnerabilities were disclosed on 1 September 2026 across Claude Code, Cursor, Codex, Goose, Hermes Agent, Qwen Code, and Grok Build
- The exploit works through malicious
.git/configfiles that execute code when the AI agent runs routine git commands in the background- Claude Code has two distinct vulnerabilities: one was patched on 29 June, a second remains unpatched as of 2.1.252
- Four agents remain unpatched as of publication: Hermes Agent, Qwen Code, Grok Build, and Claude Code's ultrareview command
- Practical mitigation requires inspecting
.git/configbefore opening untrusted repositories and disablingcore.fsmonitorglobally
How GitSpawn Works
An AI coding agent's whole job is to understand context. To do that, it runs git commands in the background—git status, git diff, branch checking—often before you have even authenticated to the agent, sometimes before you have typed a prompt.
The exploit works because Git has a configuration setting called core.fsmonitor that is meant to speed up performance. Instead of scanning the entire filesystem every time it needs to refresh the index, Git calls a command you specify in the config. That command runs automatically during index refresh.
An attacker controls the repository on disk. They set core.fsmonitor to something like /tmp/steal-keys.sh. When the AI agent runs git status on startup, Git executes that script.
The result is arbitrary code execution outside the sandbox, as the developer's user, with no approval prompt and nothing visible on screen. The attacker gains access to:
- SSH keys
- Cloud credentials (AWS, Azure, GCP, Kubernetes)
- GitHub, npm, and artifact repository tokens
- Every repository on the developer's machine
- A foothold for lateral movement to other systems
There are other attack paths too. Some variants use core.hooksPath or other configuration keys that Git will execute. Manifold's research documented eight distinct findings. The point is: once you open the malicious repository, you are compromised.
Which AI Agents Are Affected and What's Patched
Manifold Security tested seven AI coding agents. All seven were vulnerable. The patch status varies.
Patched:
- Claude Code
core.fsmonitorpath: Fixed in version 2.1.196 (patched 29 June) - Codex: Patched after disclosure
- Cursor: Patched after disclosure
- Goose: Fixed in version 1.44.0 (CVE-2026-72718)
Unpatched as of 1 September 2026:
- Claude Code ultrareview command: Unpatched, still vulnerable in 2.1.252
- Hermes Agent: Unpatched (CVE-2026-71963)
- Qwen Code: Unpatched
- Grok Build: Unpatched
The Claude Code situation is particularly important because it has two separate attack paths, and fixing one does not fix the other. Upgrading to 2.1.196 closes the core.fsmonitor route when using the main Claude Code interface. If you use claude ultrareview from the command line, a different code path runs git commands, and that path remains vulnerable.
Why This Matters for Small Businesses
This is not a bug that requires sophistication to exploit. An attacker does not need to break into your network. They need a repository to end up on a developer's machine.
That could happen in several ways. A contractor shares a project folder. Someone clones a GitHub repository that was compromised. A developer downloads a zip file from an untrusted source. Someone opens a GitHub repository in an AI coding tool without checking whether they trust it first.
For a small business or accounting firm, the risk runs deep:
- If a developer's machine holds production credentials, the attacker now holds infrastructure keys for your cloud account.
- If the machine has repository access, the attacker can push code to production.
- If you use a shared cloud credential (which is bad practice but happens), one compromised machine reaches every system that shares it.
- Accounting firms hold TFNs, bank account details, and payroll data. A compromised dev environment reaches all of it.
The fact that Claude Code and Cursor were both affected, and have been widely adopted in small dev teams over the last year, makes this a real exposure for any business running code.
What You Need to Do Right Now
You have three concrete steps.
1. Check if you are running a vulnerable version of Claude Code
If you use Claude Code, ensure you are on version 2.1.196 or later for the main interface. Check your version in the Claude Code settings. If you are on 2.1.193 or earlier, update immediately.
If you use the claude ultrareview command, you are currently vulnerable. There is no patched version available yet. Avoid opening untrusted repositories with this tool until a patch lands.
2. Inspect .git/config before opening repositories in an AI coding tool
Before you open a folder in Claude Code, Cursor, or any AI coding agent, check the repository's git configuration.
Open the folder in your terminal and run:
cat .git/config | grep -E "fsmonitor|hooksPath"If that returns anything, do not open the folder in an AI coding tool. Those configuration keys can execute code.
For repositories arriving as zip files or shared drives, extract them to a sandbox first and inspect before opening them anywhere that matters.
3. Disable core.fsmonitor globally on your development machines
Run this on your machine to turn off the attack surface entirely:
git config --global core.fsmonitor falseThis disables Git's performance optimization globally, but it removes one of the main attack vectors. You can also check what your current setting is:
git config --global core.fsmonitorIf it is empty or false, you are fine.
For Vendor Teams and Your Tech Partner
If you outsource development or have contractors opening your repositories, forward this to them and ask for confirmation they have applied one of the fixes above. If they are using Claude Code or Cursor, ask them to confirm their version.
If your tech partner builds custom software and has not addressed this, treat it as a security gap.
The Broader Pattern
GitSpawn is not new in concept. Git has had configurable code-execution settings for years. What changed is that AI coding agents started running git commands in the background before the developer knew they were there.
Earlier this year, we covered the Miasma supply chain worm, which spreads by stealing credentials from developer machines. GitSpawn is another path to the same problem. The pattern is clear: a developer's machine is the perimeter that matters now.
Firewalls and MFA on your login systems are important. But if a contractor's development laptop holds your cloud credentials, or a developer's machine can push code to production, those controls are upstream of the real exposure.
What You Should Check Next
- Ask your developers: what version of Claude Code, Cursor, or Codex are you running?
- Ask them: do you open repositories from customers or contractors in your AI coding agent?
- Ask yourself: do developer machines hold production credentials, or do they authenticate on-demand?
If the answer to any of these is "yes" or "I am not sure," you have more work to do than just applying the patch.
If you want to walk through what your actual exposure is, or talk through what a secure development environment looks like when you are using AI coding tools, that is a conversation worth having.
Frequently Asked Questions
Do I need to update Claude Code right now?
If you are on 2.1.193 or earlier, yes. If you are on 2.1.196 or later, the main interface is patched. If you use claude ultrareview, you are still vulnerable and should avoid opening untrusted repositories until a patch lands.
Can I use my AI coding agent to open customer repositories safely?
Only if you inspect .git/config first and confirm there are no malicious settings. It is safer to assume you cannot, and inspect from the terminal before opening anything in the agent.
What about Goose, Hermes Agent, Qwen Code, and Grok Build?
Goose is patched in version 1.44.0. Hermes Agent, Qwen Code, and Grok Build remain vulnerable as of 1 September 2026. If your team uses any of those tools, contact the vendor for patch status or avoid opening untrusted repositories until patches land.
Why does Git allow this in the first place?
Git's core.fsmonitor was designed as a performance optimization for large repositories. The assumption was that git configuration was trusted (it lives in .git/config on disk). AI coding agents changed that assumption by running git commands automatically without showing the user what git config settings exist.
Is this the same as the earlier Claude Code vulnerability from June?
No. The CVE-2026-55607 vulnerability from June was a different attack path involving worktree symlinks. GitSpawn is a separate issue that was independently disclosed on 1 September. Claude Code patches one but not the other, so you can be patched against one and still vulnerable to the second.
