In This Article
Key Takeaways
- Two separate 2026 disclosures — Accomplish's "leaky sandbox" findings (September 10) and Manifold Security's "GitSpawn" report — show AI coding agents can be tricked into running attacker code from a malicious repository, before any user prompt.
- GitSpawn abuses Git's core.fsmonitor setting: agents run background git status calls that execute a command an attacker planted in the repo's own .git/config, escaping the sandbox on first open.
- Patch speed varied widely: Cursor and OpenAI Codex fixed the reported bugs in about a week; Anthropic's Claude Code took roughly 50 days and 30 releases for the Accomplish-reported issue, and a second GitSpawn-class vector was still unpatched as of September 1, 2026.
- Exploitation requires the repository's actual .git directory to arrive intact — via a zip archive, shared drive, sync folder, or USB — not from an ordinary git clone.
What actually broke
Two independent research groups spent mid-2026 finding the same category of bug in AI coding agents: a way to get the agent to run attacker-chosen commands before the user ever types a prompt. Cymulate documented the pattern as "Configuration-Based Sandbox Escape" (CBSE), and separately, researcher Manifold Security published a version it calls "GitSpawn," per The Hacker News. The mechanism: Git repositories carry their own configuration in .git/config, including a setting called core.fsmonitor that tells Git which external command to run to check for changed files. AI coding agents routinely run background Git commands like git status to figure out a repo's branch and file state the moment they open it — and when they do, they execute whatever command the repository's own config points at, outside the agent's sandbox and without asking the user first.
Who found it, and how fast vendors fixed it
The first disclosure came from Accomplish, a stealth-stage cybersecurity startup based in Tel Aviv, founded by Or Hiltch, Amit Avner, and Guy Zipori. Accomplish quietly reported leaky-sandbox findings to Anthropic, OpenAI, and Cursor over the summer before going public on September 10, 2026, per Upstarts Media. Cursor and OpenAI Codex both shipped fixes in about a week. Anthropic's Claude Code took roughly 50 days and 30 releases to patch the reported issue.
Manifold Security's GitSpawn disclosures ran on a similar timeline, reported across June and July 2026, per The Hacker News. Fixes landed for goose, Claude Code (partially, for core.fsmonitor specifically), and Cursor by June 29; OpenAI Codex versions 0.102.0 through 0.130.0 were vulnerable and fixed in 0.131.0. Three assigned CVEs track the issue: CVE-2026-19592 (OpenAI Codex), CVE-2026-72718 (goose, CVSS base score 7.0), and CVE-2026-71963 (Hermes Agent, not yet published in the MITRE CVE list). A second, related Claude Code vulnerability — via the claude ultrareview path — remained unfixed as of September 1, 2026. Hermes Agent, Qwen Code, and Grok Build were all still unpatched at publication, with some reports left "untriaged" or closed as duplicates without a fix ever shipping.
Who's actually at risk
The trigger condition matters: exploitation requires the repository's actual .git directory to arrive intact on disk — through a zip archive, a shared drive, a sync folder, or a USB stick. An ordinary git clone from a remote is safe, because cloning rebuilds the local Git state rather than copying an attacker's config wholesale. The realistic risk is a developer downloading a "helpful" repository, extracting a shared archive from a teammate, or opening a project handed over on a drive, then pointing their coding agent at the folder.
Accomplish's Or Hiltch put the underlying frustration plainly: "If these frontier models are so good, how come they're not finding these critical vulnerabilities in their own products?" Co-founder Amit Avner's takeaway for teams was blunter: "Organizations need to be very wary." OpenAI told Accomplish the reported issues were addressed in August, with ongoing work to strengthen its sandbox further.
What to do this week
None of this requires waiting on a vendor patch to act on. Before opening a repository you did not clone yourself, inspect .git/config for anything unexpected, especially core.fsmonitor, core.hooksPath, or unusual filter attributes. Run git config --get core.fsmonitor against any repo you're unsure about, and if you don't rely on the feature, disable it globally with git config --global core.fsmonitor false. If you maintain or ship an agent yourself, strip untrusted configuration on background calls by pinning flags, e.g. git -c core.fsmonitor=false status, rather than trusting whatever the repository brought with it.
Sources: The Hacker News — Malicious Git configs can make Claude, Codex, Cursor run attacker code; Upstarts Media — Accomplish claims leaky sandboxes in Claude, Codex, Cursor. Analysis and framing by Precision AI Academy.
Common questions
Am I at risk if I only clone repositories from GitHub normally? No. Exploitation requires the repository's real .git directory to arrive intact through an archive, shared drive, sync folder, or USB. An ordinary git clone rebuilds local Git state and does not carry over an attacker's config.
Which AI coding tools are confirmed still unpatched? As of the disclosures, Hermes Agent, Qwen Code, and Grok Build had not shipped fixes for the GitSpawn-class issue, and a second Claude Code vector via the claude ultrareview path was unfixed as of September 1, 2026.
What's the single fastest mitigation? Run git config --get core.fsmonitor on any repository you didn't create yourself before opening it in an AI coding agent, and disable the setting globally if you don't use it: git config --global core.fsmonitor false.