AI · Security · 2026-09-09 06:53:00
On 1 September 2026, Manifold Security's Francisco Rosales published GitSpawn: eight code-execution findings across seven AI coding agents, all via the git config key core.fsmonitor, whose value is a shell command Git runs during routine index refreshes. Claude Code, Codex, Qwen Code, Goose, Grok Build, and Hermes were affected. The vector requires a directory arriving with its own .git inside, not a clone. The 2022 mitigation safe.bareRepository does not stop it; blanking core.fsmonitor at invocation does. Claude Code blanks the key and sets safe.bareRepository; OpenAI patched Codex in 0.131.0.
Auto-generated summary for reference only. RSS