A repository carrying hostile Git metadata can now seize control of the AI coding assistants that developers run locally, executing attacker-supplied commands with the user’s own rights and no approval step. Manifold Security mapped the abuse across seven command-line tools and released its findings under the name GitSpawn.
The weak point is startup behavior inherited from Git itself. Assistants consult repository-local configuration, and settings such as core.fsmonitor point Git at an external program to run on every index refresh. The tools honor that instruction without questioning where it came from.
Exploitability depends on how code arrives. Copies that preserve the embedded .git store, like archives, USB transfers, synced folders or internal drives, trigger the behavior, while a standard clone scrubs it away. Patches have landed for Cursor, goose and Claude Code. Qwen Code, Grok Build, Hermes Agent and an additional Claude Code code path were still executing hostile entries at a September 1 retest. Depending on the tool, the payload detonates ahead of the workspace-trust prompt, prior to sign-in, or on the first keypress.
OpenAI, whose Codex agent ships desktop builds for both macOS and Windows, published fixes and CVE identifiers for the same weakness, assigning CVE-2026-19590, CVE-2026-19592 and CVE-2026-19593. The goose project’s advisory, CVE-2026-72718, carries a severity score of 7.0 and notes that merely invoking its review command inside a poisoned repository is enough, with execution occurring before any model contact or approval interface.
Manifold is not the first to trip over this wiring. Sonar documented the same sink in April, and Anthropic’s June bulletin CVE-2026-55607 flagged fsmonitor execution during worktree operations. The researchers argue the flaw lives in the plumbing every agent inherits rather than in the models themselves, and recommend running assistants in sandboxed environments while treating every incoming repository as untrusted.
