GitSpawn: opening a folder is enough to run attacker code in seven coding agents
Manifold Security published eight findings across seven coding agents (Claude Code, Codex, Cursor, Grok Build, Qwen Code, goose, Hermes Agent) that all reduce to one trick: a repo's own .git/config sets core.fsmonitor to an attacker command, and any background `git status --porcelain=2 --branch` or `git diff --name-only HEAD` the agent runs to populate context executes it, with host privileges, outside the sandbox, before any trust prompt. Four of the eight were still unpatched at publication, including a second Claude Code path found 15 July 2026 that abuses a different git key and was open on 2.1.252, plus Qwen Code 0.22.3, Grok Build 1.0.13 and Hermes 0.21.0. Delivery does not need a clone: a zip, a sync folder, a shared drive or a USB stick carrying an intact .git directory is the whole attack.
↳ Follow the thread