A single line in a Git configuration file can now hijack seven of the most widely used AI coding agents on the market. Security firm Manifold Security disclosed a vulnerability class it calls GitSpawn on September 1-2, 2026, revealing eight distinct flaws spread across seven command-line coding agents.
The Vulnerability
The exploit targets a mundane background process: AI coding agents routinely run git status or git diff the moment they open a repository to orient themselves. This housekeeping step becomes the attack vector through a legitimate Git performance setting called core.fsmonitor, which names a helper program Git invokes when refreshing its file index.
When an attacker plants a malicious value for core.fsmonitor inside a repository’s .git/config file, Git automatically launches whatever command that value points to—the first time an agent runs a background status check. The result is command execution that happens outside the AI agent’s sandbox, with the developer’s full local user privileges, and without any tool-approval prompt.
Affected Agents
The vulnerability affects seven major AI coding tools:
- Anthropic’s Claude Code — two flaws, one fixed, one still live
- OpenAI’s Codex — CVE-2026-19592, patch status unclear
- Cursor — patch released
- Cognition’s Goose — patch released
- Hermes Agent — unpatched
- Alibaba’s Qwen Code — unpatched
- xAI’s Grok Build — unpatched
Four of the eight findings remained unpatched at the time of disclosure, according to Manifold Security and The Hacker News.
Attack Surface
The realistic attack surface is narrower than it might initially appear. Exploitation requires the repository to arrive as files with its .git directory intact—common in contractor handoffs, cloud-synced folders, or bug-report archives from strangers. An ordinary git clone from a remote host builds a fresh local config rather than copying the attacker’s malicious configuration.
Security Implications
This vulnerability represents a shift in AI agent attack methodology. Rather than tricking models with clever prompt injection, attackers can now simply hand developers a folder. The Cloud Security Alliance noted that GitSpawn fits a broader pattern of September 2026 CVEs hitting the infrastructure underneath AI agents rather than the models themselves—suggesting security teams should prioritize tooling and integration fixes over model training improvements.
For enterprises deploying AI coding agents, the immediate recommendations are: verify all agent patches are applied, audit incoming code repositories for suspicious .git/config entries, and treat shared project folders from external sources as potentially hostile until proven otherwise.