Your coding agent runs a stranger's code before it asks you anything
On 1st Sep'26 the security firm Manifold published GitSpawn, eight code-execution findings across seven AI coding agents: Claude Code, OpenAI Codex, Cursor, Goose, Qwen Code, Grok Build and Hermes Agent. A repository's own .git/config can name a program in the core.fsmonitor setting, and Git runs that program during any routine index refresh, which includes git status and git diff. So an agent that opens a cloned repo and checks its state executes attacker-chosen code as the developer, outside the agent's sandbox, before any trust prompt appears. Cursor, Codex and Goose have patched, Goose in version 1.44.0 under CVE-2026-72718, rated 7.0. Four of the eight findings were still exploitable at Manifold's retest on the day of publication, including a second Claude Code path on 2.1.252. Running git config --global core.fsmonitor false removes the attack surface across every repository on the machine.
What it actually means
Most of the safety thinking around coding agents has gone into what the model is allowed to do once it is running, which is why the approval prompt exists. GitSpawn goes round that, because the code runs during a routine git status before the agent has made a decision, so nothing in the permission model gets a vote.
The practical move is to treat any repository you did not create as executable content rather than text, which means turning the global fsmonitor setting off today and keeping agent work away from the machine that holds your production keys. It also settles an argument plenty of teams have been having about sandboxes, because the sandbox was real here and the code ran outside it anyway.
The sandbox was real, and the code ran outside it anyway.
4 of 8GitSpawn findings still unpatched when the research went public
Source: Manifold Security · Wednesday 16 September 2026