What happened
Manifold Security published the 'GitSpawn' vulnerability class on Sept 1, 2026, documenting eight findings across seven AI coding agents. Hermes Agent's flaw was assigned CVE-2026-71963 (CVSS 8.8) by VulnCheck after the vendor failed to respond to six contact attempts across five channels; it remained unpatched in version 0.21.0 as of the Sept 2-3 window covered by this digest, alongside Qwen Code and Grok Build.
Why it matters
This is a novel agent-execution attack class: code execution occurs entirely outside the AI agent's sandbox and approval workflow, before the model is even in the loop, purely through the agent's own background tooling. It affects the most widely-used AI coding agents in production and demonstrates that agent 'safety' controls (trust prompts, sandboxes) can be trivially bypassed by abusing legitimate developer tooling behavior.
Attack vector
AI coding agents automatically run 'git status'/'git diff' to gather repository context immediately upon opening a project folder — before any workspace-trust prompt, sandbox boundary, or user approval. Git reads the 'core.fsmonitor' setting from the repository's own .git/config and executes whatever command it names. A malicious project folder delivered as files (ZIP, shared drive, USB, sync folder — not a git clone) with a poisoned .git/config causes the agent's background git call to execute attacker code with the developer's full privileges, reaching SSH keys, cloud credentials, API tokens, and other repositories.
Affected systems
Hermes Agent 0.18.2–0.21.0 (unpatched, fix in commit f6234d0/upcoming 0.22.0); also affects Qwen Code ≤0.22.3, Grok Build ≤1.0.13 (unpatched); Claude Code (fixed 2.1.196), Goose (fixed 1.44.0, CVE-2026-72718), Codex and Cursor (patched)
Mitigation
Update to patched agent versions (Claude Code ≥2.1.196, Goose ≥1.44.0, patched Codex/Cursor). For Hermes Agent, Qwen Code, Grok Build: no vendor fix yet — inspect .git/config for core.fsmonitor before opening untrusted folders, or invoke git with 'git -c core.fsmonitor=false' / disable fsmonitor globally.