The usual git status run at agent startup executes a command from within the repository itself.

Manifold's GitSpawn vulnerability
https://www.manifold.security/blog/ai-coding-agents-git-hijack
Many CLI agents gather project context at startup via git status / git diff, and strangely, on some of them this happens before the workspace-trust prompt: on Qwen Code even before login, on Grok Build the first keystroke is enough. This allows running core.fsmonitor = <command> outside the agent's sandbox, with no approval dialog at all, under the user's privileges: SSH keys, tokens from shell config, cloud credentials, all repositories on disk.

Check .git/config before opening an agent that was obtained as a repo of files; you can also block it globally with git config --global core.fsmonitor false.

Seven agents were tested: Claude Code, Codex, Cursor, Goose, Hermes, Qwen Code, Grok Build. Already patched: Claude Code 2.1.196 (main path), Codex 0.131.0 (CVE-2026-19592), Cursor, Goose 1.44.0 (CVE-2026-72718, CVSS 7.0). In progress: Qwen Code (Alibaba SRC accepted the report — but hasn't fixed it), Grok Build, Hermes.

The deeper problem is that the agent's sandbox is an illusion here: any subprocess inherits the user's OS privileges and git's full trust model.

#claudecode #codex #cursor #security #grokbuild #qwen #goose