core.fsmonitor, run by the agent's own git status

When a coding agent opens a directory it commonly runs git status or git diff to build an index. Git reads that setting from the repository's own .git/config, and if that file names a core.fsmonitor hook, git runs the command the entry points at. Manifold Security calls the pattern GitSpawn: an untrusted repository can carry that entry, so the command runs as the developer, outside the agent's sandbox and with no approval prompt, during the agent's own housekeeping — before the workspace-trust prompt appears, and for some agents before authentication is reached at all.

The delivery vector the authors describe is directory-as-files: a shared archive, a synced folder, or removable media. Cloning, fetching, or pulling is not required. Manifold also reported the same end result in Claude Code through its ultrareview command — the git setting that triggers there is of the same kind but is not core.fsmonitor, and the authors left it unnamed while it remains unpatched.

The research produced eight findings across seven agents. Claude Code's core.fsmonitor path was reported on 26 June 2026 and patched in 2.1.196, while its ultrareview path was still unpatched on 2.1.252. Goose was assigned CVE-2026-72718 and patched in 1.44.0. Hermes carried CVE-2026-71963 and was unpatched; VulnCheck, not the vendor, assigned that identifier.

Qwen Code and Grok Build (1.0.13) were unpatched when the research went public, and OpenAI Codex and Cursor had been patched. That left four of the seven agents without a complete fix at publication — Hermes, Qwen Code, and Grok Build entirely, and Claude Code on its ultrareview path.

The authors frame the issue as a gap the permission model never sees. The workspace-trust prompt and the approval flow are the moment an agent is supposed to register what it is about to touch, and here the command has already run by the time that moment arrives. The permission model never sees it, in their account: the command runs inside the git subprocess the agent itself started, and the folder being open is all the setup it needs.

The findings were published on 1 September 2026 by Francisco Rosales of Manifold Security.