What happened
Researchers disclosed GitSpawn, a class of vulnerabilities that targets AI coding agents by weaponizing a legitimate git performance feature. When a developer clones a malicious repository and opens it with a vulnerable agent, attacker-specified code runs automatically in the background, with the same privileges as the developer's terminal session. No prompt, no approval dialog, no warning of any kind.
How the attack works
Git supports a configuration setting called core.fsmonitor that lets a repository specify a helper program. Git calls this program automatically whenever it refreshes its internal index, which happens during routine operations like git status and git diff. AI coding agents gather project context by running exactly these commands silently in the background as soon as a project is opened. That means the helper program runs before the developer types a single command. Attacker code executes immediately, silently, and with no indication in the UI.
Affected tools and patch status
Claude Code was vulnerable in version 2.1.193 and patched in 2.1.196. OpenAI Codex and Cursor have both released patches. Goose resolved its GitSpawn exposure in version 1.44.0. Hermes Agent remains vulnerable as of September 1, tracked as CVE-2026-71963. Grok Build and Qwen Code were also identified as affected; confirm patch status before continuing to use them. Any AI coding agent that gathers context by running git commands in the background should be treated as potentially in-scope.
What to do now
Update Claude Code to version 2.1.196 or later. Update Cursor and Codex to their latest releases. If your team uses Hermes Agent, Grok Build, or Qwen Code, avoid cloning repositories from untrusted sources with those tools until a patch is confirmed. As an interim control for any agent whose patch status is unclear, add this to your global git configuration: git config --global core.fsmonitor false. This disables the setting globally and prevents repository-level overrides from being honored.
The broader pattern
GitSpawn exploits the trust gap between git repositories and the agents that consume them. Agents collect context silently and automatically because that is what makes them fast and useful. The same design choice that enables accurate code assistance also creates an attack surface that does not exist in traditional IDEs. As AI coding agents acquire broader capabilities, including root access, network access, and the ability to commit and push code autonomously, the impact radius of a successful GitSpawn attack grows. Expect this class of vulnerability to recur.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you are securing AI coding agent pipelines or evaluating agent supply chain risk.