Untrusted Git Repositories Hijack AI Coding Agents
A significant security flaw, dubbed GitSpawn, has been identified across a range of popular AI coding agents, including Claude Code, Goose, Grok Build, Hermes, Qwen Code, OpenAI's Codex, and Cursor. This widespread vulnerability allows untrusted Git repositories to execute arbitrary code on a developer’s local machine with their privileges, often before workspace trust prompts appear or even before user authentication is complete. The issue stems from the improper sanitization of repository-specific Git configurations when these agents automatically gather project context in the background. Affecting products with millions of combined downloads and GitHub stars, this single flaw presents a critical risk, enabling attackers to gain deep access to developer environments through what appears to be a legitimate project.
The core mechanism behind GitSpawn exploits how AI coding agents perform routine Git operations to understand a project. Upon opening a folder, agents automatically run various Git commands, such as `git status –porcelain=2 –branch` or `git diff –name-only HEAD`, to gather necessary context. Many of these commands, particularly those interacting with the working tree, trigger Git to refresh its index. During this refresh, Git consults the repository's own `.git/config` file, which can contain settings like `core.fsmonitor`. An attacker can embed a malicious command within this configuration setting. When the AI agent executes an unsuspecting Git command that causes an index refresh, the attacker's embedded command is executed on the host system, entirely outside any sandboxed environment and bypassing explicit user approval. The primary delivery method for such weaponized repositories involves non-cloning transfers, such as shared `.zip` archives, sync folders, network drives, or USB sticks, rather than traditional `git clone` operations.
The successful exploitation of GitSpawn carries severe implications, as an attacker gains extensive control over the compromised developer's machine and sensitive assets. This includes unauthorized access to the victim's SSH keys, cloud credentials configured in their environment, tokens stored in shell configurations, and every Git repository present on the disk, effectively establishing a persistent foothold. The vulnerability is not isolated to a single vendor, indicating a systemic oversight in how AI agents handle untrusted repository configurations. While some affected agents like Goose and Claude Code (for `core.fsmonitor`) have received patches, other critical instances, such as specific Claude Code `ultrareview` and Hermes Agent variants, remain unpatched at the time of this report. The fact that five reports were filed as duplicates by independent researchers on the same day highlights the widespread recognition and critical nature of this vulnerability. CVE-2026-72718 and CVE-2026-71963, associated with some identified instances, demonstrate low but measurable probabilities of exploitation in the next 30 days according to FIRST EPSS data, underscoring a tangible, ongoing risk.
Attack Surface
Endpoint OS, Workspace, Supply Chain (Third-party vendors)
Tactics
Initial Access, Execution, Credential Access, Discovery
Techniques
- T1059.004 – Command and Scripting Interpreter: Unix Shell
- T1195 – Supply Chain Compromise
- T1204 – User Execution
- T1552.001 – Unsecured Credentials: Credentials In Files
SuperPRO's Threat Countermeasures Procedures
- Upgrade Goose to version 1.44.0 or later to mitigate CVE-2026-72718 and address the identified vulnerability.
- Upgrade Claude Code to version 2.1.196 or later to receive the patch for the `core.fsmonitor` specific vulnerability.
- Refrain from using Claude Code's `ultrareview` feature on any untrusted repositories, as versions 2.1.252 and earlier remain unpatched for this specific flaw.
- Exercise extreme caution and consider discontinuing use of Hermes Agent versions 0.21.0 or earlier, especially with untrusted projects, due to the unpatched CVE-2026-71963 and related issues.
- Manually inspect the `.git/config` file of any project folder obtained via non-cloning methods (e.g., ZIP archives, shared drives) for suspicious `core.fsmonitor` entries or other command execution sinks before opening it with an AI coding agent.
- Only obtain project folders from absolutely trusted sources and always use secure cloning methods (e.g., `git clone` from authenticated remote repositories) instead of shared archives or directories to prevent local configuration manipulation.
