Analysis
A newly disclosed vulnerability class called GitSpawn lets a booby-trapped software repository silently execute code on a developer's machine the moment it's opened with an AI coding agent -- no prompt, no approval click, and no other user interaction required, The Hacker News reported. The flaw was disclosed Sept. 2 by researcher Francisco Rosales.
How the Exploit Works
The root cause is core.fsmonitor, a Git performance setting whose value is a shell command that Git executes automatically to detect which files changed -- and Git reads that value directly from a repository's own .git/config file. Any operation that refreshes the index, including routine commands like git status or git diff, triggers the configured command. An AI coding agent that clones or opens a repository and then runs any git operation as part of its normal workflow, which nearly all of them do constantly, executes the attacker's payload without ever surfacing a warning.
“- Goose -- affected in 1.41.0, patched in 1.44.0, assigned CVE-2026-72718 with a CVSS 4.0 score of 7.0.”
Rosales confirmed GitSpawn-class issues across a wide range of AI coding agents:
- Claude Code -- affected in version 2.1.193, patched in 2.1.196; more than 77 million monthly npm downloads.
- Goose -- affected in 1.41.0, patched in 1.44.0, assigned CVE-2026-72718 with a CVSS 4.0 score of 7.0.
- Hermes Agent -- assigned CVE-2026-71963 after the vendor didn't respond across six contact attempts.
- Qwen Code and Grok Build -- also confirmed affected.
- OpenAI Codex and Cursor -- separately found vulnerable to variants of the same class and patched, though researchers flagged both findings as duplicates of issues other independent researchers had already filed.
Combined, the affected tools represent close to half a million GitHub stars, Cyberpress reported, and Claude Code's npm package alone accounts for more than 77 million monthly downloads.
Of eight distinct issues Rosales tracked across the affected tools, four remain unpatched at publication -- including a separate flaw specific to Claude Code's ultrareview command, which abuses a different git configuration key entirely and which researchers deliberately left undetailed in their disclosure to avoid handing attackers a working exploit template. That compares to Pulse's coverage this week of the actively-exploited Langflow CVE, where a disclosed flaw sat unpatched in production for eight months before attackers moved -- GitSpawn is earlier in that same lifecycle, disclosed and partially patched, with no reported real-world exploitation yet.
For any company running AI coding agents against real codebases, which by 2026 is close to universal in venture-backed engineering teams, GitSpawn is a supply-chain risk that has nothing to do with which model the agent runs and everything to do with the agent's git integration layer. VCs diligencing AI-coding-tool startups should now ask specifically about git-configuration sandboxing, not just prompt-injection defenses, since this is a mechanically different attack surface that most teams' existing AI security reviews don't cover.
The silver lining, genuinely, is that no source has reported active exploitation of GitSpawn as of publication -- this is a disclosed-and-patching-in-progress situation, not an active breach like Langflow's. But four of eight issues remaining unpatched across tools with a combined half-million GitHub stars and tens of millions of downloads is a wide, live attack surface regardless of whether anyone has used it yet, and the researchers' choice to withhold detail on the unpatched Claude Code flaw is itself a signal they judged the risk of publishing a working exploit higher than the value of full transparency.
Any engineering team running an AI coding agent against a repository it doesn't fully trust -- a pull request from an outside contributor, a cloned dependency, a candidate's take-home test -- should treat that as executing untrusted code until every affected tool confirms a patch, not after.
