A booby-trapped Git repository can run an attacker's code on a developer's machine the moment an AI coding agent looks at it. No prompt typed, no permission dialog, and in some cases before the agent has even asked whether the project should be trusted.
That is the finding behind GitSpawn, a vulnerability class disclosed on 1 September by Francisco Rosales, an offensive security engineer at Manifold Security, in the firm's write-up. It affects Claude Code, OpenAI Codex, Cursor, Goose, Hermes Agent, Qwen Code and Grok Build. Check Point Research listed it among the week's notable disclosures in its 7 September threat intelligence bulletin.
A performance setting doing the wrong job
Coding agents build context by quietly running ordinary Git commands in the background, things like git status and git diff. Each of those makes Git refresh its internal index. Git has a performance feature called core.fsmonitor, which lets a repository name a helper program that Git launches automatically whenever that refresh happens. The setting lives in the repository's own configuration file, which means a repository the attacker controls gets to choose the program.
So the developer never runs anything. The agent does, on their behalf, with their privileges.
The permission prompts never see it
Manifold's point is that the command slips past every control the agent puts in front of a user. It executes with the full privileges of the logged-in account, outside the agent's sandbox, and it does not appear in the approval flow, because as far as the agent is concerned it only ran git status. The firm lists SSH keys, cloud credentials, API tokens, shell configuration files, source code and any other repository the developer's account can reach as what an attacker would then be positioned to take.
Some agents are fixed, several are not
The remediation is uneven. Manifold says Claude Code addressed the core.fsmonitor variant in version 2.1.196 and Goose fixed its issue in 1.44.0, while OpenAI Codex and Cursor have both patched. Goose's flaw carries CVE-2026-72718 with a CVSS score of 7.0, and Hermes Agent's carries CVE-2026-71963.
On a retest dated 1 September, four were still executing repository-supplied commands: a second path in Claude Code on 2.1.252, Hermes Agent 0.21.0, Qwen Code 0.22.3 and Grok Build 1.0.13. Version numbers move fast in this category, so check what your own installation is running rather than assuming that list is still current.
One flag closes the hole
Manifold's advice to the vendors is a single line of hygiene: "Sanitize the git config on the context-gathering calls your product makes in the background, for example git -c core.fsmonitor=false status". For developers, the control is an older one that agents have made easy to forget. Cloning an unfamiliar repository has always been closer to running unfamiliar code than reading it, and pointing an agent at one collapses whatever distance was left.
It is the same shape of problem that keeps surfacing as agents get wired into real toolchains, from poisoned files tripping bugs in the major agent frameworks to an audit of 13 million tool calls showing how much these tools do without being asked. The dangerous input is not the prompt. It is everything the agent reads to work out where it is.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.