GitSpawn: opening a folder is enough to run attacker code in seven coding agents

The trick is one line in a file you never read.

Manifold Security published eight findings across seven coding agents (Claude Code, Codex, Cursor, Grok Build, Qwen Code, goose, Hermes Agent) that all reduce to the same mechanism. A repository's own .git/config sets core.fsmonitor to an attacker-chosen command. Every one of those agents runs git status --porcelain=2 --branch or git diff --name-only HEAD in the background to populate its context window. Git honors core.fsmonitor on those calls. The command executes with host privileges, outside the sandbox, before the trust prompt renders. Manifold Security

Four of the eight were still unpatched at publication. That includes a second Claude Code path found on July 15 that abuses a different git key and was open on 2.1.252, plus Qwen Code 0.22.3, Grok Build 1.0.13 and Hermes 0.21.0.

The delivery mechanism is what should bother you. You don't need to clone anything. A zip, a Dropbox folder, a shared drive, a USB stick, anything carrying an intact .git directory works. "Take a look at this repo, I zipped it up" is the entire social engineering payload. I've done that dozens of times. You probably have too.

One of these got a CVE. NVD published CVE-2026-71963 on September 3 against Hermes Agent 0.18.2 through 0.21.0, where the attacker command runs the moment the user opens the repo and sends any message, exposing the full environment including configured provider API keys. Fix is commit f6234d0. It got an ID because the vendor didn't answer across six contact attempts. The Claude Code, Cursor, Qwen Code and Grok Build variants of the identical bug have no ID at all. NVD

Manifold's vendor guidance is one flag: pass -c core.fsmonitor=false on the status and diff calls your harness makes in the background, so a repository can't supply the command git runs. Wire that into your wrapper scripts today. Four agents haven't patched it and you have no leverage over their release schedule. For folders you didn't create, run git config --local --list first. Any setting whose value names a program can run that program.

The wider pattern is what I'd flag to anyone maintaining a harness. Three separate items in 48 hours all police what a checked-out directory is allowed to make an agent do. GitSpawn's core.fsmonitor execution. A paper on attacker-controlled lifecycle-hook updates. And Cline desktop 0.0.23, which discovers Agent Plugins from ~/.agents/plugins and states in its release notes that workspace-level .agents/plugins directories are intentionally ignored. Cline

Cline drew the line on purpose: a cloned repository does not get to install its own MCP servers and skills. That refusal is the correct instinct, and GitSpawn is the demonstration of what happens without it. Every agent harness reads repo-local configuration with host privileges before a human approves anything. Enumerate every file your harness reads at session start and ask which of them can name a program. Most people will find more than one.

The lifecycle-hook paper makes the same argument with worse numbers. HookPry, an automated attack framework, trojanizes plugin update metadata so a benign versioned plugin fires attacker commands the model never observes. It compromised all seven evaluated harnesses across 25 harness-backend combinations in 1,000 end-to-end runs, with per-harness success reaching 92.5%. Microsoft Defender had 0% recall. The union of three static defenses missed 47.5% of malicious artifacts. arXiv 2609.03884

Zero percent recall from the endpoint product most enterprises are relying on. Diff the hook block on every plugin update, because nothing downstream is going to catch it for you.