GitSpawn: USB repository executes code via CLI agents

On September 1, 2026, Francisco Rosales from Manifold Security published research on GitSpawn: coding CLI agents execute code from a malicious repository at session start via the git core.fsmonitor setting without sanitizing the config, affecting 7 agents, 4 of which remain unpatched.

Compiled by Sergey KostenchukPublished 2026-09-01Updated 2026-09-18

2026-09-01 Safety OpenAI

🛡 GitSpawn: USB repository executes code via CLI agents

Francisco Rosales from Manifold Security showed: CLI agents collect context via git and do not clean its settings. The trigger is core.fsmonitor in .git/config: a repository that lands on disk as files executes its code outside the sandbox. Claude Code, Goose, Codex, and Cursor are patched; Qwen Code, Grok Build, and Hermes Agent are unpatched.

🌍 This is not a model vulnerability, but a flaw in background git collection without config sanitization: the same class was already found in GitHub Copilot CLI. Four of eight findings are unpatched.

👤 Do not open repositories received as files (archive, USB) with an agent without checking .git/config. Update Claude Code to 2.1.196+, Goose to 1.44.0+; for the rest there are no patches — manual config check is required.

Source 1: https://www.manifold.security/blog/ai-coding-agents-git-hijack Source 2: https://github.com/aaif-goose/goose/security/advisories/GHSA-r5pp-p5r8-466r

Sources