GitSpawn: a cloned repo's .git/config (core.fsmonitor) makes AI coding agents (Claude Code, Codex, Goose, Cursor, Hermes, Qwen Code, Grok Build) run attacker code before the trust prompt. Which versions are fixed and how do I protect myself?

What it is: Manifold Security disclosed 'GitSpawn' in early September 2026. Git has settings whose value is a command Git runs during routine operations; core.fsmonitor is the main one. Many command-line coding agents run git status or git diff in the background as soon as they start in a folder, before the 'do you trust this folder?' dialog and outside their sandbox. A repository or archive you received can ship its own .git/config with such a setting, so simply opening it with an agent can run the attacker's program with your user's access (SSH keys, cloud credentials, other repos). Am I affected / fixed versions reported: - Goose before 1.44.0 (CVE-2026-72718), fixed in 1.44.0. - OpenAI Codex CLI 0.102.0 to 0.130.0, fixed in 0.131.0; Codex desktop apps fixed in 26.519.x builds. - Claude Code: the reported case was fixed in 2.1.196; The Hacker News listed the fix as partial for some later builds, so run the latest version. - Cursor was reported as patched. Hermes Agent, Qwen Code and Grok Build were reported unpatched at disclosure; check their current release notes. - Plain git used by you on your own repos is not the issue; the risk is opening untrusted repositories or archives with an agent. Fix: 1. Update every coding agent you use to its latest version. 2. Before opening a repo or archive from someone else with any agent, inspect its .git/config: git config --local --list, and look for core.fsmonitor, core.hooksPath, core.sshCommand, core.editor, core.pager or diff/filter driver commands. Note that a global setting does not override these, because the repository's own config takes precedence; check the local file itself. 3. Open untrusted repositories in a disposable VM, container or dev container without your real credentials, or clone them fresh yourself from the original source instead of using a received folder or archive. After: if you opened an untrusted repo with an affected agent version, check for unexpected processes, new SSH keys, shell profile changes and cloud API activity, and rotate credentials that were available in that session. Sources: https://labs.cloudsecurityalliance.org/research/csa-research-note-gitspawn-ai-coding-agent-rce-20260903-csa/ https://thehackernews.com/2026/09/malicious-git-configs-can-make-claude.html https://git-scm.com/docs/git-config#Documentation/git-config.txt-corefsmonitor