Security Vulnerability Discovered in AI Coding Agents Exploiting Git Repository Configurations for Arbitrary Code Execution

A security vulnerability named 'GitSpawn' has been discovered, allowing arbitrary code execution due to improper sanitization of Git commands executed in the background by AI coding agents to gather project context. This vulnerability occurs before the user inputs anything or before a workspace trust prompt is displayed, enabling attackers to steal SSH keys, cloud credentials, and other sensitive data with developer privileges outside the sandbox.

Vulnerability Mechanism and Impact

Agents execute commands such as git status or git diff at the start of a session to collect repository information. If specific configuration values included in the repository's .git/config, such as core.fsmonitor, are passed through without being removed, Git treats them as executable files and executes commands on the host system. This is a structural flaw stemming from the agent's default behavior (plumbing), rather than a judgment error by the model.

Status by Major Agent

Researchers discovered 8 vulnerabilities across 7 agents, with 4 remaining unpatched as of the time of publication.

• Claude Code: The core.fsmonitor vulnerability has been patched, but another Git configuration vulnerability in the ultrareview path remains unpatched even in version 2.1.252.
• Goose: Assigned CVE-2026-72718 and fixed in version 1.44.0.
• Hermes Agent: Assigned CVE-2026-71963, but remains unpatched due to delayed vendor response.
• Qwen Code: Reported to the Alibaba Security Response Center, but confirmed unpatched in version 0.22.3.
• Grok Build: Reported to xAI but closed due to duplicate processing, and remains unpatched in version 1.0.13.
• OpenAI Codex & Cursor: Handled as duplicate reports, but already patched.

Mitigation Measures

Users must inspect the .git/config file before opening externally received repository folders with AI agents. Developers should explicitly disable or sanitize unnecessary configurations when calling Git for context collection, such as using git -c core.fsmonitor=false. This issue is classified as a security blind spot in the broader ecosystem, rather than a mistake by a specific vendor.