Skip to content
NewsIncident

GitSpawn: malicious .git config files execute attacker code in Claude Code, Codex, and Cursor before trust prompts appear

· by Pondero Newsdesk

The short version

Manifold Security disclosed GitSpawn on September 12, showing that a poisoned core.fsmonitor entry in a .git/config triggers at AI agent startup with no user interaction. Claude Code is partially patched; Cursor shipped a fix three weeks before the disclosure date.

GitSpawn: malicious .git config files execute attacker code in Claude Code, Codex, and Cursor before trust prompts appear

Security firm Manifold Security disclosed a class of repository-delivery attacks on September 12 that can silently execute attacker-controlled code inside Claude Code, Codex CLI, and Cursor the moment a developer opens a coding session. The payload fires in a Git subprocess before any agent trust dialog appears, making the attack effective regardless of how an agent's permissions are configured.

What

Manifold named the vulnerability class GitSpawn. The attack exploits core.fsmonitor, a Git performance setting that instructs Git to run a helper command when checking for file changes. Any agent that calls git status or git diff at session startup reads the repository's own .git/config automatically. When an attacker places a malicious command in that field, Git executes it with the developer's system privileges before returning control to the agent, per the disclosure covered by The Hacker News.

The attack requires the target repository to arrive as a file bundle with an intact .git directory. A standard git clone strips unsigned config entries and is not vulnerable. Delivery vectors include ZIP archives, USB drives, and synced folders.

Patch status as of September 12:

  • Cursor: Fixed three weeks before public disclosure.
  • Codex CLI: Patched in version 0.131.0; current release is 0.152.1. CVE-2026-19592 assigned.
  • Claude Code: Fixed for the core.fsmonitor path in version 2.1.196; the ultrareview code path remained unpatched as of 2.1.252.
  • Goose: Patched in 1.44.0. CVE-2026-72718 assigned.
  • Hermes Agent, Qwen Code, Grok Build: Unpatched as of disclosure.

No active exploitation has been reported.

Why it matters

The threat model here breaks a common assumption about agent security. GitSpawn runs in the OS-level Git subprocess, before model inference starts and before Claude Code's workspace-trust prompt or Qwen Code's authentication dialog can appear. Code executes with the developer's full system privileges, silently, from within what looks like a normal repository.

Developers who treat third-party ZIP archives or sync-folder snapshots as equivalent to a clean git clone now have a concrete reason to inspect .git/config before opening any externally sourced project in an agent. Manifold recommends disabling the hook entirely: git config --global core.fsmonitor false in any terminal stops repositories from invoking monitored hooks.

Cursor users running a version newer than three weeks before September 12 are protected. Codex users on 0.131.0 or later are patched. Claude Code users should verify they are on a build at or past 2.1.196 and should treat the ultrareview exposure as unresolved until Anthropic ships a follow-up fix. To verify your Cursor version or grab the latest release, visit Cursor.

What to watch next

Anthropic has not published a formal security advisory or patch timeline for the ultrareview code path. Manifold indicated it will continue testing other coding agents, including Cline, Continue, and GitHub Copilot agent mode, which could widen the list of affected tools.

Sources