Gitspawn
gitspawn: one line in a repo's git config executes attacker code in seven coding agents — claude code, codex, cursor, grok build among them — before any approval prompt, and four of eight findings shipped unpatched. the supply chain now attacks the tool that reads the repo.
your agent's first action is the most dangerous one.
Context
A Cloud Security Alliance research note dated 3 September 2026 summarizes Manifold Security's GitSpawn disclosure: eight related findings across seven agents (Claude Code, OpenAI Codex, Cursor, Grok Build, Goose, Hermes Agent, Qwen Code), four unpatched at publication. The mechanism is a repository's .git/config entry such as core.fsmonitor that runs on routine git status, executing code with the developer's privileges without any approval prompt. Its status table dated 1 September 2026 lists Claude Code core.fsmonitor as patched (v2.1.196) but a separate ultrareview key as unpatched (v2.1.252), and Codex, Cursor and Goose fsmonitor as patched.
The note's counts match the secondary summary. The unpatched findings are other paths, so four of eight shipped unpatched is a point-in-time claim as of 1 September 2026, not about all named agents. The before-approval detail varies by agent. Manifold's own disclosure was not fetched, so this is secondary-supported only, and current patch status was not checked. The first action is the most dangerous is the author's opinion.
Watch next
- Manifold's own disclosure and current patch status.
Sources
- GitSpawn research note (Cloud Security Alliance, 3 Sep 2026)labs.cloudsecurityalliance.org
Provenance
The note above is reproduced unedited from the original post, first published on Threads on 18 September 2026 at 11:20 IST. Sources are the papers and datasets the note draws on.
View the original post ↗Embed this note
More notes
The air is now being asked to keep its own ledger
the air is now being asked to keep its own ledger: ecmwf’s aifs compo becomes the first ai model to forecast atmospheric composition globally every three hours, cleanair simulates 365 days of pm2.5 over china in ten seconds, and a unified framework maps six pollutants at one kilometer across the whole country. the air now files its own composition report.
read the note →The current is now being asked to draw its own map
the current is now being asked to draw its own map: china’s langya 2.0 predicts six ocean phenomena including internal waves and mesoscale eddies, a deep net called wenhai resolves eddies globally with air sea flux formulas built in, and scripps infers surface currents from the way temperature patterns deform in satellite images. the ocean now files its own circulation report.
read the note →The soil is now being asked to report its own carbon
the soil is now being asked to report its own carbon: a nix color sensor paired with generative data augmentation predicts soil organic carbon without a lab, random forest drives 74 percent of soil health mapping studies, and sentinel 2 tracks five year carbon change across france and italy from 922 samples. the dirt now files its own carbon account.
read the note →