The fastest-growing class of software on developer laptops is the AI coding agent, and the latest disclosure against it involves no prompt injection, no jailbreak, and no model at all. Per The Hacker News, researchers at Manifold Security published eight vulnerabilities, grouped under the name GitSpawn, across seven command-line agents. The trigger is an old Git performance setting. The payload runs with the user’s full privileges before the agent ever asks whether the workspace is trusted.
The plumbing, not the model
Git’s core.fsmonitor setting names an external command that Git runs to learn which files have changed. It lives in .git/config inside the repository itself. When an agent starts a session, it quietly shells out to git status or git diff to work out the current branch and which files are dirty. If the repository arrived with a poisoned config, that background call executes whatever command the attacker wrote. Manifold described the issue as living “in the ordinary plumbing underneath”, not in anything new. OpenAI’s advisory for Codex (CVE-2026-19592) is explicit that the helper runs outside the command sandbox and without an approval prompt, so attacker code can read, change, or delete the user’s files.
The timing is what defeats the existing controls. On Claude Code and Hermes Agent the payload fires before the workspace-trust dialog. On Qwen Code it fires before the user has authenticated. On Grok Build it fires on the first keystroke. The GitHub advisory for goose puts it bluntly: running a review inside a malicious repo executes attacker code with no prompt, no model call, and no tool approval.
Who patched and who didn’t
Fixes shipped for goose (1.44.0), Codex CLI (0.131.0) and its desktop builds, Cursor, and Claude Code 2.1.196 for the core.fsmonitor path (CVE-2026-55607). As of Manifold’s September 1 retest, Hermes Agent, Qwen Code, and Grok Build remained exposed, and a second Claude Code path through its review command was still live on 2.1.252. The goose flaw, CVE-2026-72718, carries a CVSS 4.0 base score of 7.0.
The regression history is the uncomfortable part. Sonar reported the same sink in April and noted that Anthropic had mitigated it in November 2025 by no longer running git status before trust approval, only for a related path to reappear in June’s 2.1.193 release. This is well-trodden ground for IDEs, too: VS Code (CVE-2021-43891) and JetBrains (CVE-2022-24346) both had pre-trust bypasses on the same primitive, and Cobalt published a red-team writeup on FSMonitor abuse last December. The primitive was known; the new agents simply inherited it.
The delivery constraint
A standard git clone does not carry the remote’s config, so the attack needs a repository that arrives with its .git directory intact: a zipped archive, a shared drive, a cloud-sync folder, or a USB stick. That narrows the surface but does not remove it. Vendor sample projects, hand-off bundles between contractors, and “just unzip this” onboarding kits are exactly how code moves inside many enterprises. Bruce Schneier flagged the broader pattern the same week: agents treat whatever they find in a repository or vendor doc as ground truth, and the humans supervising them rarely question it. No exploitation in the wild was reported, and none of the CVEs were in CISA’s KEV catalog as of September 2.
What this means
For security teams, the lesson is that an agent sandbox is only as good as the subprocesses spawned before the sandbox is armed. Inventory which CLI agents developers actually run, pin them to patched versions, and treat unpacked repositories from outside the organisation like any other untrusted executable: strip or inspect .git/config before anyone opens the folder. Above all, add “what runs at startup” to your agent threat model. The prompt is not the only input an attacker controls.
