--- title: "GitSpawn - Malicious .git Configs Make Coding Agents Run Attacker Code" description: "Manifold's GitSpawn (Sep 1 2026): malicious .git/config core.fsmonitor runs on git status/diff during agent context gather - outside sandbox, no approval. Patched in goose, Codex, Cursor, Claude Code; several agents still open." url: "https://anomity.ai/blog/gitspawn-malicious-git-config-coding-agent-rce/" source: html --- On this page - What happened - Patch and exposure matrix (as of Manifold's Sep 1 retest) - Why this is an agentic-endpoint risk - How Anomity surfaces and governs it - What to check across your fleet - Frequently asked questions [← Back to blog](https://anomity.ai/blog/) - Home - Blog - GitSpawn - Malicious .git Configs Make Coding Agents Run Attacker Code ![Anomity robot illustrating GitSpawn - Malicious .git Configs Make Coding Agents Run Attacker Code] Advisory Critical # GitSpawn - Malicious .git Configs Make Coding Agents Run Attacker Code Anomity Research Anomity Threat Research · Sep 14, 2026 · 5 min read Share: Copied AI Agent & CLI Security · Critical · GitSpawn (Manifold, 2026-09-01); CVE-2026-72718 (goose), CVE-2026-19592 (Codex CLI), CVE-2026-71963 (Hermes) · Sep 14, 2026 Affected Coding agents that run git status/diff during context gather against untrusted .git/config (fsmonitor and related). Patched: goose 1.44.0+, Codex CLI 0.131.0+, Cursor (vendor patch), Claude Code core.fsmonitor fixed by 2.1.196. Unpatched at Manifold Sep 1 retest: Hermes, Qwen Code, Grok Build, Claude Code ultrareview path. On **1 September 2026**, **Manifold** disclosed **GitSpawn**: malicious **.git/config** entries - especially **core.fsmonitor** - that cause coding agents to execute attacker-controlled commands when they run routine **git status** or **git diff** during context gathering. The Hacker News and a Cloud Security Alliance research note covered the same findings in the days that followed. This advisory summarizes the verified facts, the patch matrix Manifold reported, and how to inventory and govern the agent/Git hinge across a fleet. ## What happened Coding agents gather repository context by shelling out to Git. When a project ships a poisoned **.git/config**, Git honors helpers such as **core.fsmonitor** on status and diff. That helper is a command path chosen by whoever wrote the config. Manifold showed the resulting process runs **outside the agent sandbox** and typically **without an approval prompt**, because the agent asked Git for status - not for permission to run an arbitrary binary. Delivery is deliberately mundane. The attacker does not need the victim to **git clone** a hostile remote. A **zip file or shared folder** that already contains a `.git/` directory with the malicious config is enough: the developer opens the folder in the agent, the agent runs status/diff, and GitSpawn fires. That is a different shape from clone-time trust assumptions many teams still use when they review "where did this repo come from." The pattern sits next to other Git-config trust failures on coding endpoints - including the [Cursor Git-hooks sandbox escape](https://anomity.ai/blog/cursor-git-hooks-sandbox-escape-rce-cve-2026-26268/) and [Cursor DuneSlide sandbox escapes](https://anomity.ai/blog/duneslide-cursor-sandbox-escape-cve-2026-50548-50549/) - and next to project-file execution before consent such as [Claude Code project-file RCE and token exfiltration](https://anomity.ai/blog/claude-code-project-file-rce-token-exfil-cve-2025-59536/). The shared lesson: **repository-local configuration is an execution path**, not documentation. ## Patch and exposure matrix (as of Manifold's Sep 1 retest) - goose 1.44.0 - fixed; tracked as CVE-2026-72718 (CVSS 7.0 ). - Codex CLI 0.131.0 - fixed; tracked as CVE-2026-19592 . - Cursor - vendor patch reported for the GitSpawn / fsmonitor class. - Claude Code - core.fsmonitor path fixed by 2.1.196 ; Manifold still flagged an ultrareview path as open at retest. - Hermes - still unpatched at retest; tracked as CVE-2026-71963 . - Qwen Code and Grok Build - still unpatched at Manifold's 1 September retest. Treat that matrix as a point-in-time snapshot from the disclosure. Before closing a ticket, confirm the current release notes for each agent your developers actually run - especially Codex desktop versus CLI strings, Claude Code ultrareview status, and whether Hermes **CVE-2026-71963** has a fixed build in your channels. ## Why this is an agentic-endpoint risk The dangerous surface is the **coding agent plus Git**, not a remote service. Status and diff are everyday agent behaviors described in guides such as the [OpenAI Codex sandbox and approval model](https://anomity.ai/blog/openai-codex-sandbox-and-approval-model/) and the broader [securing AI coding agents and CLIs](https://anomity.ai/blog/securing-ai-coding-agents-and-clis/) pillar. When those ops honor attacker-controlled `.git/config`, the sandbox and approval story your team thinks it bought does not cover the spawn. Network and EDR still see a legitimate `git` parent launching a helper. DLP does not see a "malicious tool call" because the agent never framed one. The exposure lives in the AI artifact layer: which agents and CLIs are installed, which versions, and whether they auto-run Git against trees that arrived as archives. That is one of the [eight AI artifact types](https://anomity.ai/#features) Anomity tracks per endpoint - the same shadow-IT dynamic as [AI agents becoming the new shadow IT](https://anomity.ai/blog/ai-agents-are-the-new-shadow-it/). ## How Anomity surfaces and governs it Patching each agent closes the specific GitSpawn paths vendors have fixed. The durable control is still to **see which agents run where** and to **decide tool and subprocess behavior before it runs**. Anomity does that in three steps. First, **inventory**. The Endpoint Sensor inventories **agents and CLIs** (among the eight AI artifact types) on every managed endpoint, so you can find builds that still match Manifold's unpatched set - Hermes, Qwen Code, Grok Build, and older goose / Codex / Claude Code / Cursor versions - without waiting for a developer survey. Metadata only; secrets are redacted on the endpoint. Second, **decide at the hook**. On agents that expose a hook such as Claude Code **PreToolUse**, [runtime governance](https://anomity.ai/#runtime-governance) returns **allow, deny, or log** before the call runs. That does not replace vendor GitSpawn patches, but it gives you a policy boundary for high-risk tool and shell behavior while vulnerable builds are still rolling off the fleet. Third, **keep the record**. Every decision lands in a [queryable 90-day audit trail](https://anomity.ai/#outcomes) and can route to SIEM, Slack, email, or Jira. When the next Git-config disclosure lands, you answer from a record which endpoints ran which agents - not from a guess. Anomity is SOC 2 Type II and complements Network, EDR, DLP, and GRC; it covers the artifact layer those tools were not built to inventory. See [how it works](https://anomity.ai/#how-it-works) or [book a 30-minute demo](https://anomity.ai/#early-access). ## What to check across your fleet - Inventory every endpoint running goose, Codex CLI, Cursor, Claude Code, Hermes, Qwen Code, or Grok Build, and compare versions to Manifold's Sep 1 matrix (goose 1.44.0+ , Codex CLI 0.131.0+ , Claude Code 2.1.196+ for the fsmonitor path, Cursor patched builds). - Treat zip / shared-folder project intake as untrusted input equal to cloning an unknown remote - inspect .git/config for fsmonitor , hooks, and other helper keys before an agent opens the tree. - Disable or ignore repository-local Git helpers in enterprise Git policy where feasible, and alert on unexpected .git/config writes. - Re-verify Claude Code ultrareview and Hermes CVE-2026-71963 status on current releases before closing the ticket. - Confirm coding-agent tool calls are evaluated with allow/deny/log at the agent hook, and that decisions land in a 90-day audit trail . GitSpawn is another reminder that **agent context gathering is an execution surface**. Patch the agents Manifold named, assume archive delivery is in scope, and inventory the coding-agent fleet so the next `.git/config` helper does not land on an invisible population. For sandbox and approval baselines, see the [Codex sandbox and approvals guide](https://anomity.ai/blog/securing-openai-codex-sandbox-and-approvals-guide/). To inventory and govern coding agents across your endpoints, [book a 30-minute demo](https://anomity.ai/#early-access). Share: Copied ## Frequently asked questions What is GitSpawn? GitSpawn is the name Manifold gave to a class of coding-agent remote code execution disclosed on 1 September 2026. An attacker plants a malicious Git configuration - commonly core.fsmonitor - inside a project's .git/config. When a coding agent later runs git status or git diff to gather repository context, Git launches the configured helper, and the attacker's command runs on the developer workstation. The chain does not need the agent to approve a shell tool call; Git is doing the spawn. Why does core.fsmonitor matter for coding agents? core.fsmonitor tells Git which program to run when it wants filesystem-change hints. Agents routinely invoke git status and git diff while building context for a task. If that config points at attacker code, those everyday Git operations become the execution trigger. Because the spawn comes from Git rather than from an agent tool policy, it often runs outside the sandbox and without the approval UI developers expect for dangerous commands. Which agents were patched, and which were still open? Per Manifold's disclosure and follow-on coverage: goose fixed the issue in 1.44.0 under CVE-2026-72718 (CVSS 7.0); Codex CLI fixed it in 0.131.0 under CVE-2026-19592; Cursor shipped a vendor patch; Claude Code fixed the core.fsmonitor path by 2.1.196. At Manifold's 1 September retest, Hermes remained tracked as CVE-2026-71963, and Qwen Code, Grok Build, and a Claude Code ultrareview path were still unpatched. Teams should re-verify current release notes for each agent before treating a build as closed. How is this different from the Cursor Git-hooks sandbox escape? The Cursor Git-hooks issue (CVE-2026-26268) centered on an agent writing Git hooks from inside a sandbox so a later Git operation ran outside it. GitSpawn centers on a pre-planted .git/config helper that fires when the agent merely reads repository state. Both abuse Git's trust in repository-local configuration; the delivery and trigger differ. Defenders should treat any agent that auto-runs Git against untrusted trees as in scope for both patterns. How does Anomity reduce exposure to this class of flaw? Anomity inventories AI agents and CLIs on every managed endpoint, so you can find which endpoints still run unpatched coding-agent builds. On agents that expose a hook such as Claude Code PreToolUse, Anomity returns allow, deny, or log before a tool call runs, and records decisions in a queryable 90-day audit trail routed to SIEM, Slack, email, or Jira. Metadata only leaves the endpoint; secrets are redacted on-device. That complements Network, EDR, DLP, and GRC controls that were not built to inventory the agent artifact layer. ## Related [Guide ### When a Coding Agent Drops Your Database: Why It Happens and the Guardrails That Stop It Agents drop databases because they hold write credentials and migration tooling is destructive by design. The fix is credentials and deny-lists, not better prompts. Anomity Research · Aug 5, 2026 · 6 min](https://anomity.ai/blog/agents-destructive-database-operations-guardrails/) [Guide ### How Claude Code Hooks Work - Events, Matchers, and the PreToolUse Enforcement Point Claude Code hooks run your code at fixed points in the agent's lifecycle. This guide explains the events, matchers, and decision control, and why PreToolUse is the enforcement point that matters. Anomity Research · Jul 18, 2026 · 6 min](https://anomity.ai/blog/how-claude-code-hooks-work/) [Advisory Critical ### Langflow unauthenticated RCE - CVE-2026-48519 CVE-2026-48519: a Langflow unauthenticated RCE in the Shareable Playground through 1.9.1. A public build link runs arbitrary Python. Fixed in 1.9.2. Anomity Research · Jun 16, 2026 · CVE-2026-48519](https://anomity.ai/blog/langflow-shareable-playground-rce-cve-2026-48519/) ## Structured data ```json { "@context": "https://schema.org", "@type": "TechArticle", "headline": "GitSpawn - Malicious .git Configs Make Coding Agents Run Attacker Code", "description": "Manifold's GitSpawn (Sep 1 2026): malicious .git/config core.fsmonitor runs on git status/diff during agent context gather - outside sandbox, no approval. Patched in goose, Codex, Cursor, Claude Code; several agents still open.", "datePublished": "2026-09-14", "dateModified": "2026-09-14", "author": { "@type": "Organization", "name": "Anomity", "url": "https://anomity.ai/", "sameAs": [ "https://www.linkedin.com/company/anomity", "https://github.com/Anomity-ai", "https://www.wikidata.org/wiki/Q140763940" ] }, "publisher": { "@type": "Organization", "name": "Anomity", "url": "https://anomity.ai/", "sameAs": [ "https://www.linkedin.com/company/anomity", "https://github.com/Anomity-ai", "https://www.wikidata.org/wiki/Q140763940" ], "logo": { "@type": "ImageObject", "url": "https://anomity.ai/icon-512.png" } }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://anomity.ai/blog/gitspawn-malicious-git-config-coding-agent-rce/" }, "image": { "@type": "ImageObject", "url": "https://anomity.ai/assets/blog/covers/coding-agents.jpg", "width": 1200, "height": 630 }, "articleSection": "AI Agent & CLI Security", "url": "https://anomity.ai/blog/gitspawn-malicious-git-config-coding-agent-rce/", "keywords": "GitSpawn coding agent git config RCE, GitSpawn (Manifold, 2026-09-01); CVE-2026-72718 (goose), CVE-2026-19592 (Codex CLI), CVE-2026-71963 (Hermes), GitSpawn, git config, core.fsmonitor, coding agents, remote code execution, Codex CLI, Claude Code, Cursor, goose, agentic AI security" } ``` ```json { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What is GitSpawn?", "acceptedAnswer": { "@type": "Answer", "text": "GitSpawn is the name Manifold gave to a class of coding-agent remote code execution disclosed on 1 September 2026. An attacker plants a malicious Git configuration - commonly core.fsmonitor - inside a project's .git/config. When a coding agent later runs git status or git diff to gather repository context, Git launches the configured helper, and the attacker's command runs on the developer workstation. The chain does not need the agent to approve a shell tool call; Git is doing the spawn." } }, { "@type": "Question", "name": "Why does core.fsmonitor matter for coding agents?", "acceptedAnswer": { "@type": "Answer", "text": "core.fsmonitor tells Git which program to run when it wants filesystem-change hints. Agents routinely invoke git status and git diff while building context for a task. If that config points at attacker code, those everyday Git operations become the execution trigger. Because the spawn comes from Git rather than from an agent tool policy, it often runs outside the sandbox and without the approval UI developers expect for dangerous commands." } }, { "@type": "Question", "name": "Which agents were patched, and which were still open?", "acceptedAnswer": { "@type": "Answer", "text": "Per Manifold's disclosure and follow-on coverage: goose fixed the issue in 1.44.0 under CVE-2026-72718 (CVSS 7.0); Codex CLI fixed it in 0.131.0 under CVE-2026-19592; Cursor shipped a vendor patch; Claude Code fixed the core.fsmonitor path by 2.1.196. At Manifold's 1 September retest, Hermes remained tracked as CVE-2026-71963, and Qwen Code, Grok Build, and a Claude Code ultrareview path were still unpatched. Teams should re-verify current release notes for each agent before treating a build as closed." } }, { "@type": "Question", "name": "How is this different from the Cursor Git-hooks sandbox escape?", "acceptedAnswer": { "@type": "Answer", "text": "The Cursor Git-hooks issue (CVE-2026-26268) centered on an agent writing Git hooks from inside a sandbox so a later Git operation ran outside it. GitSpawn centers on a pre-planted .git/config helper that fires when the agent merely reads repository state. Both abuse Git's trust in repository-local configuration; the delivery and trigger differ. Defenders should treat any agent that auto-runs Git against untrusted trees as in scope for both patterns." } }, { "@type": "Question", "name": "How does Anomity reduce exposure to this class of flaw?", "acceptedAnswer": { "@type": "Answer", "text": "Anomity inventories AI agents and CLIs on every managed endpoint, so you can find which endpoints still run unpatched coding-agent builds. On agents that expose a hook such as Claude Code PreToolUse, Anomity returns allow, deny, or log before a tool call runs, and records decisions in a queryable 90-day audit trail routed to SIEM, Slack, email, or Jira. Metadata only leaves the endpoint; secrets are redacted on-device. That complements Network, EDR, DLP, and GRC controls that were not built to inventory the agent artifact layer." } } ] } ``` ```json { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://anomity.ai/" }, { "@type": "ListItem", "position": 2, "name": "Blog", "item": "https://anomity.ai/blog/" }, { "@type": "ListItem", "position": 3, "name": "GitSpawn - Malicious .git Configs Make Coding Agents Run Attacker Code", "item": "https://anomity.ai/blog/gitspawn-malicious-git-config-coding-agent-rce/" } ] } ```