Opening a project folder can turn an AI coding assistant into an unwitting command runner, Manifold researchers warn. They catalogued eight such flaws across seven command-line tools and published the research as GitSpawn.
The trigger is core.fsmonitor, a Git tuning knob whose value is a command defined in the repository’s own .git/config. Git executes that command during everyday operations such as status and diff, and the coding agents call the same plumbing at startup to learn which branch they are on. When a repository arrives as an archive, a shared folder, or a USB stick, its .git directory survives intact, so opening it can run the command with the user’s privileges, outside the agent sandbox and with no approval prompt.
Fixes have shipped for goose, Claude Code, and Cursor. Still exposed when Manifold retested on September 1 were Qwen Code, Grok Build, Hermes Agent, and a second Claude Code path. OpenAI published CVE-2026-19592 for the same class in Codex that day, and GitHub advisory CVE-2026-72718, rated CVSS 7.0, covers the goose issue.
No exploitation has been reported, and none of the identifiers sit on CISA’s known exploited list. Manifold says the pattern shows up in more agents than it named, and that vendors should treat every subprocess an agent spawns at startup as a trust boundary.
