Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code

Manifold Security (dubbed 'GitSpawn') disclosed eight security flaws across seven AI coding agents that can be exploited via malicious Git repository configurations. The attack vector abuses the Git 'core.fsmonitor' setting, a legitimate Git performance feature whose value is a shell command that Git executes to identify changed files. Git reads this setting from the repository's own .git/config file. When an AI coding agent opens a repository and runs background Git operations (such as 'git status' or 'git diff') to determine the current branch and changed files, it inadvertently executes the attacker-controlled command specified in core.fsmonitor. The command executes with the user's privileges, outside the agent's sandbox, and without any user approval prompt. Exploitation requires the repository to arrive with its .git directory intact (e.g., via shared archive, shared drive, sync folder, or USB stick — not via ordinary git clone). On Claude Code and Hermes Agent, the payload fires before the workspace-trust prompt is accepted; on Qwen Code, before authentication; and on Grok Build, on the first keystroke. A second Claude Code attack path exists through 'claude ultrareview' using a different, undisclosed Git configuration key. Five of Manifold's eight reports were duplicates of independently filed findings. Cobalt's red-team research notes that FSMonitor abuse exploits a legitimate feature, not a bug, leveraging the intersection of Git's flexibility and IDE automation to turn a repository open event into code execution. The vulnerability class previously affected Visual Studio Code (CVE-2021-43891) and JetBrains IDEs (CVE-2022-24346).