Loading story…
Manifold Security disclosed GitSpawn, a vulnerability class in which AI coding agents automatically invoke Git commands such as git status or git diff while opening a repository, causing attacker-controlled core.fsmonitor commands in the repository’s .git/config to execute. The commands run with the developer’s local user privileges, outside the agent sandbox and before trust or approval controls may apply, enabling code execution without a build step or explicit user action. The technique extends a previously demonstrated abuse of Git’s legitimate FSMonitor feature, which can also trigger when IDEs such as VS Code or Cursor inspect a malicious repository.
Affected products reportedly included goose, OpenAI Codex, Claude Code, Hermes Agent, Qwen Code, Grok Build, and Cursor. Patches were available for goose, Codex, Cursor, and one Claude Code path, while Hermes Agent, Qwen Code, Grok Build, and another Claude Code issue remained unresolved or unpatched. The primary exposure is repositories delivered locally with a preserved .git directory, including ZIP archives; ordinary cloning, pulling, and fetching do not transfer the malicious local configuration. Organizations should treat locally received repositories as untrusted, audit for suspicious core.fsmonitor settings, disable FSMonitor by default where feasible, and update affected agent tools.
Track how attackers are adapting to this technology.
11 events from the most recent confirmed update back to the earliest known activity.
Manifold tested Claude Code version 2.1.252 and found that a separate command-execution path through claude ultrareview remained active, despite a fix for the core.fsmonitor path.
CVE-2026-71963 affects Hermes Agent versions 0.18.2 through 0.21.0, where a malicious repository can set core.fsmonitor and cause command execution when a user opens it and sends a message. The issue was fixed in commit f6234d00c5d59450adea1d7edd30ad3859375c79; exploitation could expose the user's environment, including configured provider API keys.
Manifold reported confirmed GitSpawn exposure in Hermes Agent, Qwen Code, and Grok Build, with fixes pending or unresolved. Qwen Code could execute before authentication, while Grok Build could trigger execution on the first keystroke; xAI reportedly closed the Grok report as a duplicate of an earlier informative report.
Cursor remediated a related repository-supplied setup-command issue in its CLI that could execute before the workspace-trust prompt and outside the product sandbox.
Anthropic fixed the core.fsmonitor GitSpawn path affecting Claude Code 2.1.193 by version 2.1.196. A separate claude ultrareview path remained unresolved in Manifold's later testing.
OpenAI fixed the affected Codex CLI releases in version 0.131.0 and released fixed Codex Desktop versions for macOS and Windows. OpenAI published three CVEs for the vulnerability class, including CVE-2026-19592, which could permit code to read, modify, or delete user files and access account-available resources.
Goose versions before 1.44.0 were affected by the repository-controlled fsmonitor execution issue, and version 1.44.0 fixed it. GitHub assigned CVE-2026-72718, with a CVSS 4.0 base score of 7.0.
Manifold Security disclosed eight GitSpawn flaws across seven command-line AI coding agents. Received repositories retaining a malicious .git/config could cause background Git operations such as status or diff to execute attacker-controlled commands as the developer, outside agent sandboxes and without approval.
Anthropic's June advisory for CVE-2026-55607 identified execution of Git fsmonitor during Claude Code worktree operations.
Sonar reported the same Git execution sink in April and noted earlier workspace-trust-dialog bypasses affecting Visual Studio Code and JetBrains IDEs. The report identified repository-triggered Git execution as a risk before the later GitSpawn disclosure.
A proof of concept showed that a malicious repository can set core.fsmonitor in .git/config to an attacker-controlled script, which can execute when IDEs such as VSCode or Cursor automatically run Git commands on opening the folder. The demonstration worked on macOS and was described as adaptable to Windows and Linux; it abuses legitimate Git behavior rather than a patched vulnerability.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
6 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcecvefeed.io
Open sourcethehackernews.com
Open sourceheise.de
Open sourcemanifold.security
Open sourcecobalt.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Novee Security disclosed at Black Hat USA 2026 that AI coding agents tied to GitHub workflows can be manipulated through untrusted issue, pull request, and workflow-generated content to execute malicious actions inside repositories they are meant to maintain. Testing of **Anthropic Claude Code**, **Google Gemini CLI**, and **OpenAI Codex** against the vendors’ own public repositories and default setups showed paths to **remote code execution**, credential theft, repository tampering, and software supply-chain compromise without requiring privileged access. Researchers said the weakness lies primarily in the surrounding agent harnesses—tool permissions, execution controls, and sandboxing—rather than the underlying models. Reported exploitation paths included command-validation bypasses, unenforced shell restrictions, secret exposure through `/proc`, and persistent instruction poisoning across multi-pass workflows. Anthropic remediated **`CVE-2026-54316`** in Claude Code versions `0.2.54` through `2.1.162`; Google patched Gemini CLI versions before `0.39.1`, preview versions before `0.40.0-preview.3`, and `run-gemini-cli` GitHub Action versions before `0.1.22`; OpenAI mitigated Codex workflow risk by isolating agent runs and using read-only environments. The researchers said they found similar insecure patterns in more than 100 public repositories and reported no evidence of malicious exploitation in the wild.
Aug 7, 2026
Researchers disclosed a Windows arbitrary code execution flaw in the Cursor AI coding IDE that causes the application to automatically run a malicious `git.exe` placed in the root of a repository when the project is opened. Mindgard said the issue stems from Cursor's Git path resolution logic searching the workspace itself for Git binaries, enabling attacker-controlled code to execute with the developer's privileges without clicks, prompts, or warnings; the payload may also be triggered repeatedly during normal use. In a demonstration, Mindgard renamed Windows Calculator to `git.exe` and showed Cursor launched it simply by opening the poisoned repository. Mindgard said it first reported the vulnerability to Cursor in December 2025, later resubmitted it through HackerOne after contacting the company's CISO, and that the flaw was still present in Cursor version `3.2.16` as of late April 2026 and in the latest version it tested before publication. Cursor told Dark Reading it was addressing the issue. Until a fix is available, Mindgard urged developers to open untrusted repositories only in isolated environments and recommended enterprise Windows controls such as **AppLocker** or **Windows App Control** to reduce exploitation risk.
Jul 18, 2026
Mozilla’s **0DIN** researchers demonstrated a supply-chain-style proof of concept in which an AI coding agent such as **Claude Code** can be manipulated into compromising a developer’s machine while cloning and initializing a seemingly benign GitHub repository. The repository itself can appear clean, with a legitimate-looking `README` and no obviously malicious code, but a staged setup flow causes a package to fail until initialization and prompts the agent to run follow-up commands it interprets as routine recovery steps. In the demonstrated chain, an initialization script fetched attacker-controlled data from a **DNS TXT** record and executed it, with the TXT record carrying a base64-encoded reverse-shell payload that could give the attacker interactive access under the developer’s privileges. Researchers warned that such access could expose environment variables, API keys, local configuration files, source code, documents, browser sessions, passwords, and enable persistence, while remaining difficult for scanners, human reviewers, and AI agents to detect because each step appears normal in isolation. They said threat actors could distribute these repositories through fake job offers, tutorials, blog posts, or direct messages, and urged agentic tools to reveal the full execution chain, including dynamically fetched scripts and runtime code.
Jul 13, 2026