Claude Code, Cursor, OpenAI Codex, and four other AI coding agents ran attacker-controlled code from a booby-trapped folder without an approval prompt. On some, it ran the moment the folder was opened: before a prompt was typed, before the workspace-trust dialog was accepted, and in at least one case before the user had even authenticated. On others, it ran on the first keystroke, the first message, or a routine review command.

What actually happened

On September 1, 2026, researcher Francisco Rosales at Manifold Security published GitSpawn: eight code-execution findings spanning seven AI coding agents, all sharing one root cause (Manifold Security). Every agent named (Claude Code, OpenAI Codex, Cursor, Block's Goose, Alibaba's Qwen Code, xAI's Grok Build, and Hermes Agent) runs git commands such as git status or git diff in the background to gather context about the project, some at start-up and some once the session begins. On Claude Code and Hermes Agent, that call runs the payload before the workspace-trust prompt is accepted. On Qwen Code it runs before the user has authenticated at all, and on Grok Build at the first keystroke of a prompt (Manifold Security, The Hacker News).

That routine, unprompted git call is the entire vulnerability. Git supports a setting called core.fsmonitor, a genuine performance feature that lets Git hand off change-detection in large repositories to an external program. The setting lives in the repository's own .git/config, not anywhere global or user-controlled. Point core.fsmonitor at a script planted inside the repo, and the next git status (the one the agent runs on its own, unasked) executes it, on the host, outside whatever sandbox the agent normally runs its own actions in (Manifold Security, GBHackers).

Why a normal git clone doesn't save you

The one detail that makes GitSpawn easy to underestimate: cloning a repository the ordinary way doesn't carry this risk, because git clone builds a fresh local config and doesn't import the remote's settings. The attack needs the .git directory to arrive intact as files, which means the vector is anything that moves a folder instead of cloning it: a shared .zip, a network drive, a synced folder, a USB stick handed off at a conference or between contractors. None of that is exotic. It's how source code moves around outside of GitHub every day, especially between organizations that don't share a git remote.

Once that folder lands on disk and an AI coding agent is pointed at it, the compromise doesn't wait for a decision. There is nothing to click through, nothing to approve, and nothing that shows up on screen. The payload runs with the developer's own local privileges, the same account that holds SSH keys, cloud CLI credentials, API tokens in shell config, and read access to every other repository on that machine.

Patched, unpatched, and stuck in between

By Manifold's retest on September 1, four of the seven agents had shipped fixes: Goose, Cursor, OpenAI Codex, and one of the two vulnerable paths in Claude Code. Four findings were still exploitable at publication: Hermes Agent, Qwen Code, Grok Build, and a second, separate configuration path in Claude Code (Manifold Security, The Hacker News, Cyberpress). GitHub's advisory for the Goose finding assigned it CVE-2026-72718 with a CVSS base score of 7.0, crediting Rosales. VulnCheck, acting as an independent CVE Numbering Authority rather than the vendor, separately assigned CVE-2026-71963 to the Hermes Agent finding, whose private report Nous Research never triaged, though The Hacker News noted that as of September 2, MITRE's public CVE list didn't yet show a corresponding record. As of that date, Anthropic's advisory record covered neither Claude Code finding (Manifold Security, The Hacker News).

Claude Code's history with this exact behavior is also worth knowing, because it shows how easily a fixed trust-boundary bug can come back. Sonar had already published research on a version of this problem, git status executing before Claude Code's trust dialog, in April 2026, after Anthropic had fixed it: version 2.0.34 mitigated it by no longer running git status ahead of trust approval, and 2.0.71 fixed the related paths Sonar also reported, through other pre-trust git commands and Claude Code's own project settings (Sonar). The same startup behavior was back in version 2.1.193, which shipped on June 25. Manifold reported it the next day, the report was closed as a duplicate of one filed earlier that day, and 2.1.196 fixed it on June 29 (The Hacker News). The path still open on Manifold's September 1 retest is a separate finding: claude ultrareview uses a different git setting, and its July 15 report was closed as a duplicate of an internal ticket (Manifold Security).

The suggested vendor fix is almost anticlimactic given the impact: call git -c core.fsmonitor=false status for background context-gathering instead of a bare git status. One flag, no architecture change, no user-visible behavior difference, and it closes the core.fsmonitor path. It does not close the whole class. Manifold notes that core.fsmonitor is not the only git setting of its kind, and the still-open Claude Code path uses a different one, so vendors need to sanitize the git config on every background call, not just switch off one key (Manifold Security).

What to do about it, regardless of which agent you run

  1. Set a safe global default, but know its limit. git config --global core.fsmonitor false disables the setting by default (The Hacker News). It does not override a repository's own .git/config: Git reads that file after the global one, and the last value it finds wins (Git documentation). A booby-trapped folder ships exactly that file, so this default does not close the vector. The inspection in step 2 is the check that matters.
  2. Treat any repo that arrived as files, not a clone, as untrusted until checked. Before opening a .zip, network-drive copy, or USB-delivered folder in an AI coding agent or an IDE, inspect its .git/config for core.fsmonitor, core.hooksPath, or clean/smudge filters.
  3. Update your agents now. Goose, Cursor, OpenAI Codex (the CLI is fixed in 0.131.0, per The Hacker News), and Claude Code's primary path have fixes; confirm your fleet is on a patched build rather than assuming auto-update caught it.
  4. Push the default through configuration management, not developer memory. A one-line git default is exactly the kind of control that should live in your endpoint baseline or onboarding image, not in a wiki page nobody rereads.
  5. Watch for regressions, not just initial fixes. Claude Code's own history here shows a patched trust-boundary bug can resurface in a later release; if you rely on a vendor's fix, periodically re-verify it rather than treating "patched" as permanent.

Where MBCTG fits

This is a governance gap as much as a technical one: most organizations that rolled out AI coding agents did it faster than they extended their tool-approval process to cover what those agents do before a human ever clicks anything. That's exactly the review our AI Integration work is built around: assessing what an AI tool can actually reach and do, in your environment, before it's standard-issue for every developer. For teams that need that evaluation turned into a repeatable, auditable process rather than a one-time check, our GRC services help make tool approval a documented control instead of an assumption.

Not sure what your own developer fleet's git defaults look like, or whether your AI coding agents were part of any security review before rollout? Talk to an MBCTG expert. Auditing agent trust boundaries is a fast, concrete place to start.