AI 安全／程式代理
GitSpawn Bypasses Coding Agent Sandboxes via Malicious `.git/config`; Four Vulnerabilities Remained Unpatched at Disclosure
Multiple CLI coding agents run Git status queries before trust confirmation, allowing executable repository configurations to run on the host with the user’s privileges. The attack does not propagate through a normal `git clone`, but can be triggered by delivering a complete `.git` directory via ZIP archives, synced folders, or USB drives.
Manifold Security disclosed a shared weakness named GitSpawn: when CLI agents including Claude Code, Codex, Cursor, Goose, Hermes Agent, Qwen Code, and Grok Build start, they invoke commands such as `git status` and `git diff` in the background to gather project context. When Git refreshes the index, it reads the repository’s own `.git/config`; if `core.fsmonitor` is set to an attacker-controlled program, Git executes it directly by design. Because the subprocess is spawned by the agent’s host-side application, the command can run outside the sandbox, before any approval prompt, with the privileges of the account that launched the agent. [Manifold’s technical disclosure](https://www.manifold.security/blog/ai-coding-agents-git-hijack) states that, among eight reported issues, the primary startup paths in Codex, Cursor, Goose, and Claude Code had been patched. Retesting as of September 1 found that Qwen Code 0.22.3, Grok Build 1.0.13, Hermes 0.21.0, and the `ultrareview` path in Claude Code 2.1.252 remained affected. The Goose vulnerability was assigned CVE-2026-72718, while the Hermes vulnerability was assigned CVE-2026-71963. [The Hacker News](https://thehackernews.com/2026/09/malicious-git-configs-can-make-claude.html) also confirmed that four issues remained unpatched at the time of disclosure.
The attack boundary needs to be clear: a normal clone, fetch, or pull does not transfer repository-local configuration. An attacker must deliver the entire directory, including `.git`, through a ZIP archive, shared drive, synchronization service, or physical media. This remains a practical supply-chain entry point because consultant deliverables, incident-forensics files, and internal project snapshots are often distributed through these channels. Engineering teams should first update their agents, inspect unfamiliar `.git/config` files in an isolated environment, and ensure that every background Git invocation made by an agent explicitly overrides the setting with `core.fsmonitor=false`. Blocking this key alone is insufficient: settings such as `core.hooksPath` and external diff or merge tools can also point to executables. The long-term fix is to treat repository configuration as untrusted input and place context collection within the same authorization and sandbox boundaries as other operations.