You don't need to download anything suspicious for a coding agent to run an attacker's command on your machine. It just has to read the .git/config of a repository that reached you through a USB drive, a shared folder, or a backup, and never went through a normal git clone.
What is the GitSpawn flaw, and how does it work?
Git's core.fsmonitor setting lets a repository declare an external command to detect changed files, used during routine operations like git status and git diff. The problem: several coding agents run that command in the background, straight from the repository's own .git/config, without asking for approval. If the command there is malicious, the agent runs it as you, outside any sandbox the agent's own tool calls would normally get.
Exploitation requires a specific condition: the repository has to arrive with its .git folder intact, something a zip file, a shared folder, a USB drive, or a backup preserve, but an ordinary git clone does not.
Which agents were affected, and who patched first?
Security firm Manifold identified eight flaws across seven coding agents, naming the vulnerability class GitSpawn (full disclosure, 2026-09-01). The same day, OpenAI itself published three separate CVEs for Codex, each credited to a different research group. GitHub assigned a CVSS score of 7.0 to CVE-2026-72718.
| Tool | Vulnerable version | Status as of 2026-09-01 |
|---|---|---|
| goose | before 1.44.0 | Patched |
| Codex CLI | through 0.130.0 | Patched in 0.131.0 |
| Codex Desktop (macOS/Windows) | multiple versions | Patched |
| Cursor | before the patch | Patched 3 weeks before disclosure |
| Claude Code | 2.1.193 | Patched in 2.1.196, this path only |
| Hermes Agent | 0.18.2 and 0.21.0 | Still vulnerable |
| Qwen Code | 0.19.6 and 0.22.3 | Still vulnerable |
| Grok Build | 0.2.93 and 1.0.13 | Still vulnerable |
Source: Manifold Security, 2026-09-01, and The Hacker News coverage. Zero documented exploitation as of publication.
Is patching one path enough?
Not necessarily, and this is where the case gets interesting. Claude Code patched the core.fsmonitor path in version 2.1.196. The same research, retesting after that patch, confirmed a second path to the same kind of execution, this time via claude ultrareview, still active on version 2.1.252.
The real point isn't which tool "won" or "lost." It's that patching one specific vulnerability doesn't close the whole class of problem: any place in an agent that trusts repository-supplied configuration before any trust prompt is a candidate for the next GitSpawn.
Does this mean I should stop using coding agents?
No. The vector requires a specific scenario (a repository arriving with an intact .git folder outside a normal clone), and no real exploitation had been documented as of the research's publication. But the pattern is worth the question: before trusting an agent with full access to your terminal, it's worth knowing whether it asks for approval before running ANY command coming from repository configuration, not just the code you're reading.
We checked Verboo Code's public source code and found no use of core.fsmonitor or core.hooksPath. That's not a guarantee against the whole risk class, it's what we confirmed so far, and it's the kind of check that should be routine for any agent running on your terminal. Meet Verboo Code at verboo.ai.
