Nous Research - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/nous-research/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 02 Sep 2026 14:20:59 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgArbitrary Code Execution in AI Coding Agents via Git Configurationhttps://feed.craftedsignal.io/briefs/2026-09-gitspawn-ai-agent-rce/Wed, 02 Sep 2026 14:20:59 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-gitspawn-ai-agent-rce/Multiple AI coding agents are vulnerable to arbitrary code execution due to the automated, unsandboxed execution of commands defined within a repository's local Git configuration, specifically the 'core.fsmonitor' setting.Manifold Security has disclosed eight security vulnerabilities affecting seven command-line AI coding agents, collectively dubbed GitSpawn. The flaw stems from the agents' behavior of reading and executing commands defined in a repository's local Git configuration file ('.git/config') during routine repository indexing operations like 'git status' or 'git diff'. Specifically, the 'core.fsmonitor' Git configuration parameter, which is intended to identify changed files, can be abused by an attacker to specify an arbitrary command that the host agent executes. This command runs with the privileges of the developer, bypasses the agent's sandbox, and executes before any user-approval or workspace-trust prompt. Impacted agents include goose, Claude Code, Cursor, Codex, Hermes Agent, Qwen Code, and Grok Build. While some vendors have released patches, others remain vulnerable. Exploitation requires the victim to open a malicious repository containing a manipulated '.git' directory, typically provided via shared archives, sync folders, or removable media.

Attack Chain

  1. Attacker creates a malicious Git repository containing a crafted '.git/config' file.
  2. The '.git/config' file is modified to set 'core.fsmonitor' to an arbitrary malicious command or script path.
  3. The repository is delivered to a developer via a shared folder, USB drive, or archive that preserves the hidden '.git' directory.
  4. The developer opens the repository directory using an affected AI coding agent.
  5. The AI agent initiates a background Git operation (such as 'git status' or 'git diff') to index the workspace.
  6. Git reads the malicious 'core.fsmonitor' configuration and automatically executes the defined command.
  7. The command executes on the developer's machine with user-level privileges, outside the agent's sandbox.
  8. Final objective is achieved, such as file exfiltration, unauthorized file modification, or further payload delivery.

Impact

The vulnerability allows unauthenticated attackers to achieve full code execution on developer machines, potentially leading to the theft of source code, credentials, or other sensitive files accessible to the user. While no widespread in-the-wild exploitation has been confirmed as of September 2026, the potential for supply chain attacks against software development organizations is significant. Multiple agents remain unpatched as of the disclosure, and the issue affects major platforms including Windows, macOS, and Linux.

Recommendation

  • Immediately audit development environments for the listed vulnerable AI coding agent versions and apply patches where available (e.g., upgrade goose to 1.44.0+).
  • Globally disable the 'core.fsmonitor' feature in Git configuration for untrusted repositories by running 'git config --global core.fsmonitor false'.
  • Inspect '.git/config' files for suspicious 'core.fsmonitor', 'core.hooksPath', or 'attr.tree' entries before opening repositories with AI-integrated tools.
  • Deploy detection rules to identify execution of Git sub-processes initiated by AI agent binaries that contain suspicious command-line arguments.
]]>highthreatsupply-chainrceai-securitygit