Malicious .git Configs Trigger RCE in Claude, Codex, Cursor AI Agents

Manifold Security has disclosed eight security vulnerabilities across seven command-line AI coding agents that allow attackers to execute arbitrary code through malicious Git configuration files. The flaws, collectively dubbed "GitSpawn," exploit the `core.fsmonitor` setting—a Git performance feature whose value is a command Git runs to identify changed files. Since Git reads this setting from the repository's own `.git/config`, any operation that refreshes the index, including `git status` and `git diff`, will execute the attacker-controlled command. The command runs as the user, outside the agent's sandbox and without an approval prompt, with exploitation requiring only that the repository arrive as files with its `.git` directory intact—something a shared archive, shared drive, sync folder, or USB stick preserves, but a standard `git clone` does not.

On Claude Code and Hermes Agent, the payload fires before the workspace-trust prompt is accepted; on Qwen Code, before user authentication; and on Grok Build, on the first keystroke. Fixes have shipped for goose, Claude Code, and Cursor, while Hermes Agent, Qwen Code, Grok Build, and a second path in Claude Code remained vulnerable when Manifold retested them on September 1. OpenAI simultaneously published three CVEs—covering the identical class in Codex CLI and Codex Desktop—credited to three unrelated research groups. "The helper runs outside Codex's command sandbox and without a user-approval prompt, allowing attacker-controlled code to run with the user's privileges," OpenAI said in CVE-2026-19592.

Affected versions include goose (prior to 1.44.0), Codex CLI (0.102.0–0.130.0), Codex Desktop for macOS (260202.0859–26.513.31313), Codex Desktop for Windows (26.304.38–26.513.40821), Claude Code (2.1.193 and 2.1.252 confirmed), Hermes Agent (0.18.2 and 0.21.0), Qwen Code (0.19.6 and 0.22.3), and Grok Build (0.2.93 and 1.0.13). "The vulnerability is not in the model, or in anything new. It is in the ordinary plumbing underneath, the subprocess an agent spawns at session startup to work out where it is," Manifold wrote, adding that it found the pattern in more agents than it publicly named.

Developers should immediately verify their AI coding agent versions, apply available patches, and audit any repositories received through file shares or external storage for suspicious `.git/config` entries—especially the `core.fsmonitor` directive. Security teams can use the port scanner to confirm no unexpected services are exposed on developer workstations, and run a privacy checkup to assess overall endpoint exposure. Organizations should also revisit supply chain practices for distributing code repositories, as this attack vector bypasses traditional sandboxing by exploiting trusted Git plumbing that AI agents rely on for basic context awareness.