Security researchers have disclosed a class of vulnerabilities affecting the most widely used AI coding agents — including Anthropic’s Claude Code, OpenAI’s Codex, Google’s Gemini CLI, and Cursor — that allows malicious Git repositories to execute arbitrary code on a developer’s machine before any sandbox protection can kick in. The flaw, which researchers are calling GitSpawn, exploits a subtle but fundamental trust assumption that these tools share, and it illustrates a growing tension at the heart of how AI systems interact with the software development ecosystem.
The disclosure, which researchers at Manifold Security coordinated with additional findings from stealth startup Accomplish, comes after months of quietly notifying affected vendors. The results were uneven: some fixes arrived in days, while one critical patch took approximately 50 days from initial report to resolution.
The Git Config Trap
The vulnerability class centers on a Git performance feature called core.fsmonitor. The setting is designed to speed up Git operations by telling Git which command to run when it wants to check for changed files. That command is read directly from the repository’s .git/config file — a file that exists inside any cloned repository and can be written by whoever controls that repository.
On its own, this is not a security vulnerability. The problem arises when AI coding agents clone a repository and begin operating inside it — reading files, suggesting edits, running checks — before they have fully verified the repository’s trustworthiness. At that point, Git may automatically execute whatever command is written into core.fsmonitor, and that command runs not inside the agent’s sandbox, but with the same permissions as the agent’s host process.
The result is what researchers at Manifold Security describe as a “trust handoff flaw.” The agent never leaves the sandbox. It follows every rule. But by faithfully executing Git’s normal behavior, it allows code from an untrusted repository to run outside the protective boundaries the agent’s developers intended.
“It’s a fundamentally different category from a classic sandbox escape,” said one researcher familiar with the disclosures. “The agent doesn’t break out. It hands a key to something that was already outside.”
What the Researchers Found
In their testing, the researchers identified several specific conditions that made the vulnerability particularly dangerous in AI contexts.
On Claude Code, the researchers found that the malicious payload from a crafted .git/config fires before the workspace-trust prompt is even presented to the user — meaning the user has no opportunity to decline before the code runs. On Qwen Code, the equivalent trigger occurred before the user had completed authentication. On Grok Build, the researchers were able to trigger the flaw on the first keystroke after cloning.
A separate but related vulnerability was tracked as CVE-2026-48124 and involved Claude hooks configuration files. The flaw, fixed in Claude Code version 3.0.0, could allow a workspace-control configuration file to execute commands outside the sandbox environment. Anthropic’s fix took approximately 50 days to arrive after the initial report, a timeline that researchers noted fell well outside what they considered acceptable for a remotely exploitable issue affecting a widely deployed developer tool.
Cursor and OpenAI responded to their respective reports in approximately one week, which researchers characterized as appropriate.
The Broader Landscape
The disclosure is the latest in a series of findings that collectively suggest the security envelope around AI coding agents has not kept pace with their proliferation. According to industry estimates, AI coding assistants are now used by more than 60 percent of professional software developers, and tools like Claude Code and Codex have moved beyond autocomplete into fully autonomous, multi-step workflows capable of modifying entire codebases, opening pull requests, and executing shell commands.
That expanded capability surface creates expanded attack surface. Earlier this year, a supply chain attack on a widely used VS Code extension demonstrated that the pipeline from open-source repository to developer environment is already a well-understood attack vector. GitSpawn adds AI coding agents as a new node in that chain — one that may actually be more dangerous than a traditional extension because AI agents are explicitly designed to clone and traverse arbitrary repositories as part of their normal operation.
Separate research from Pillar Security, also released this week, describes what it calls the “expand beyond the sandbox” problem: the tendency for AI agents to broker trust between their sandboxed environment and trusted tools running outside it, creating channels that attackers can exploit without ever touching the sandbox wall directly.
The Patch Gap
The variance in vendor response times has become a focal point in the security community’s reaction to the disclosures. The 50-day window between Anthropic’s initial notification and the release of the Claude Code patch drew particular scrutiny, given that the company has invested heavily in its reputation for safety-conscious development.
Anthropic has not commented publicly on the specific timeline. The fix, released in version 3.0.0, addresses the hook configuration vulnerability, and the company has separately noted that the core.fsmonitor issue is mitigated in recent builds through enhanced repository trust verification at clone time. Researchers have not independently confirmed whether those mitigations are comprehensive.
For developers, the practical guidance from all of the disclosing researchers is consistent: do not clone untrusted repositories with AI coding agents unless you are running the most recent version of the tool, and even then, treat repositories from unknown sources with the same caution you would apply to executing a binary downloaded from the internet.
What It Reveals About AI Security Maturity
GitSpawn illustrates something broader about the state of AI developer tooling security: the category is moving faster than the security ecosystem that surrounds it. The tools are new, the deployment patterns are novel, and the attack surface they create does not always map cleanly onto the mental models that developers, security teams, or even the vendors themselves have inherited from pre-AI tooling.
The coordination between Manifold Security, Accomplish, and Pillar Security — three separate organizations that arrived at related findings through independent research — suggests that the community is beginning to take this seriously. The fact that one of the affected vendors needed 50 days to ship a patch for a reported critical vulnerability suggests that not all of the vendors have fully internalized the stakes.
AI coding agents are now deeply embedded in professional development workflows. The security infrastructure around them needs to catch up — and the GitSpawn disclosures have made clear that the window for a quiet, coordinated fix may be closing.
