SERVANTSTACK // INCIDENT INTELLIGENCEFORENSIC IMAGE // VERIFIED FRAMEManifold Security
GitSpawn Lets a Hostile Repository Run Code on Seven AI Coding Agents Before Any Approval Prompt
On September 1, 2026, Manifold Security disclosed GitSpawn, a vulnerability class in which a hostile repository's .git/config file can set Git's core.fsmonitor option to an arbitrary command that seven popular AI coding agents triggered on the host, with the developer's own privileges, before any approval prompt appeared. Four CVEs were assigned; as of September 25, 2026, none is listed in CISA's Known Exploited Vulnerabilities catalog and no in-the-wild exploitation has been confirmed.
- 01TRIGGERManifold Security researchers Francisco Rosales and Ax Sharma found that when an AI coding agent opens a repository…
- 02MACHINE ACTIONAutonomous actor
- 03MISSING GATERisk-based SME approval before execution
- 04IMPACTData security
The short version
On September 1, 2026, Manifold Security disclosed GitSpawn, a vulnerability class in which a hostile repository's .git/config file can set Git's core.fsmonitor option to an arbitrary command that seven popular AI coding agents triggered on the host, with the developer's own privileges, before any approval prompt appeared. Four CVEs were assigned; as of September 25, 2026, none is listed in CISA's Known Exploited Vulnerabilities catalog and no in-the-wild exploitation has been confirmed.
Case telemetry
- INCIDENT
- SS-IR-111
- DATE
- September 1, 2026
- SYSTEM
- Manifold Security
- LOCATION / SCOPE
- Global; affects developers using AI coding agents against untrusted repositories
- EVIDENCE
- Documented
- AI ROLE
- Autonomous actor
- HARM
- Data security
- SOURCES
- 2 cited records
The event
Manifold Security researchers Francisco Rosales and Ax Sharma found that when an AI coding agent opens a repository and runs a routine background Git command to refresh its index or gather context, it inherits Git's core.fsmonitor feature: a setting that lets any repository specify a command for Git itself to execute during that refresh. Because the tested agents ran these background Git operations automatically, a hostile repository's own configuration file could trigger command execution on the developer's machine, with the developer's own privileges, before the agent ever surfaced a command for approval - the compromise happened as a side effect of the agent simply opening the repository. As the researchers put it: "The repository names a command, git runs it, on the host, with the user's privileges, before any approval prompt." Manifold tested seven agents and found the flaw present, in one variant or another, across all of them. At disclosure, Goose (CVE-2026-72718, CVSS 7.0) and OpenAI Codex (CVE-2026-19592 per The Hacker News, patched in CLI version 0.131.0) were fixed, along with Cursor; Claude Code had closed the core.fsmonitor path in version 2.1.196, but a second path reachable through its "ultrareview" feature remained live on the version Manifold tested (CVE-2026-55607, reported by The Hacker News); Hermes Agent (CVE-2026-71963), Qwen Code, and Grok Build remained unpatched at publication, with Manifold saying it made six contact attempts across five channels to Hermes's maintainers since July 20 without a fix landing before disclosure.
What the machine did
The AI agents did not choose to run malicious code; the vulnerability lived in ordinary agent behavior that developers rely on - background Git operations the agents perform automatically to stay aware of a repository's state. The agents' causal role was to act as the trigger: by running an unsanitized Git index-refresh operation against an untrusted repository, they invoked a Git-native code-execution path that had nothing to do with the models' own reasoning or intent. This is a tooling and integration failure, not agents behaving deceptively or escalating privileges on their own initiative, and Manifold's disclosure documents a proof-of-concept vulnerability class with no confirmed real-world attack.
Where the failure landed
Manifold's disclosure produced four CVEs (CVE-2026-72718, CVE-2026-19592, CVE-2026-55607, and CVE-2026-71963) across the affected agents. At publication, three of the seven tested agents, plus one unresolved path in a fourth, remained unpatched, and Manifold said six contact attempts across five channels to Hermes Agent's maintainers, starting July 20, had not produced a fix by disclosure. CISA's Known Exploited Vulnerabilities catalog, current as of September 25, 2026, lists none of the four CVEs, and no in-the-wild exploitation of GitSpawn had been publicly reported as of that date.
Documented
Supported by Manifold Security's technical disclosure with reproduced proof-of-concept behavior, independent CVE tracking by The Hacker News, and a direct check of CISA's KEV catalog. The evidence establishes a disclosed, researcher-demonstrated vulnerability class across multiple AI coding agents; it does not establish in-the-wild exploitation, which is unconfirmed and absent from CISA's KEV catalog as of September 25, 2026.
SOURCE RECORD UPDATED 2026-09-01
2 cited records
- 01
- 02
Risk-based SME approval before execution
The failure pattern in this case: High-stakes output had no accountable checkpoint.
The moment the path could change
The appropriate subject-matter expert reviews the evidence, exceptions, and affected people before the output becomes action.
Autonomy is a design choice.
See the operating model that keeps AI useful while preserving human authority at consequential moments.
Compare AgenticAI and AugmentedAI →