GitSpawn: 8 flaws in 7 CLI coding agents

Manifold Security disclosed GitSpawn, eight vulnerabilities across seven command-line coding agents including Claude Code, Codex CLI, Cursor and Qwen Code. Malicious settings in a repository's .git/config, such as core.fsmonitor, execute commands when the agent runs git status or git diff in the background, bypassing the sandbox and approval prompts.

• Affected agents include Claude Code, Codex CLI, Cursor, Hermes Agent, Qwen Code, Grok Build and goose
• Payload fires before the workspace-trust prompt in Claude Code and Hermes
• Fixes shipped in goose 1.44.0, Codex CLI 0.131.0 and Claude Code 2.1.196
• Attack requires a folder with an intact .git directory, not a git clone