Cursor

GitSpawn (CVE-2026-72718); a hostile repository's own git config runs arbitrary commands during AI coding agents' routine startup housekeeping, before any trust prompt

Manifold Security's GitSpawn research starts from an operational fact about how CLI AI coding agents behave: on opening a folder, several gather repository context by running ordinary git commands (git status, git diff) before the agent has received a prompt, shown a workspace-trust dialog, or in some cases completed authentication (Manifold Security, 2026-09-01). Any git command that refreshes the index honours the repository's own .git/config, including core.fsmonitor, a performance hook where git hands the index refresh off to an external helper program named in that config file. A hostile .git/config setting [core] fsmonitor = <arbitrary command> turns the agent's own routine startup housekeeping into unconditional command execution, with no approval prompt and nothing shown on screen (Manifold Security, 2026-09-01). Delivery is narrower than a typical supply-chain vector: cloning, fetching or pulling from a hostile URL does not carry .git/config across, so the repository has to arrive as files with its .git directory already present, a shared zip, a sync folder, a shared drive, or a USB stick, the way colleagues and consultants routinely hand off projects (Manifold Security, 2026-09-01).

Manifold reports eight findings across seven agents, four of which remain unpatched at publication. Confirmed patched: Goose's git diff sink during goose review (CVE-2026-72718, CVSS 4.0 7.0, fixed in 1.44.0), Claude Code's core.fsmonitor sink (fixed in 2.1.196), OpenAI Codex, and Cursor. OpenAI separately disclosed and patched three of its own CVEs for a distinct Codex helper mechanism in the same vulnerability class, crediting three unrelated research groups; only CVE-2026-19592 is named in the cited reporting, describing a helper that runs outside Codex's command sandbox without a user-approval prompt and can read, change or delete the user's files (The Hacker News, 2026-09-02). Confirmed unpatched as of Manifold's 1 September 2026 recheck: Claude Code carries a second, separate sink in claude ultrareview, "not core.fsmonitor ... a different git setting of the same kind, one the review path does not strip," per Manifold, which withholds the specific config key while it remains unfixed; Qwen Code's git status fires at startup, before authentication; Grok Build's payload fires on the first keystroke, with an earlier July report on the same class closed by xAI as "informative"; and Hermes Agent's git status on first message remains unpatched despite six contact attempts across five channels, with VulnCheck assigning CVE-2026-71963 in the vendor's place (Manifold Security, 2026-09-01; The Hacker News, 2026-09-02). Manifold states the underlying pattern is not limited to the named agents and spans both major AI labs and large software companies (heise Security, 2026-09-02).

Mitigation is two-sided: a defender receiving a repository as files should inspect .git/config before opening it in any agent (any entry naming an external program is suspicious) and an agent vendor's own fix is to sanitise the git config on context-gathering calls, e.g. git -c core.fsmonitor=false status (Manifold Security, 2026-09-01). Triage: a git subprocess spawned by an AI coding agent that itself spawns a further, unrelated child process, particularly one launched before the agent has logged any user prompt or shown a trust dialog, is not normal agent startup behaviour and is the observable signature the mechanism supports.

SANDWORM_MODE, an npm supply-chain worm that 'lives off the AI toolchain', poisoning MCP servers in AI coding assistants to steal developer credentials

CrowdStrike's research describes SANDWORM_MODE as a multi-stage npm supply-chain worm (first discovered February 2026) that targets AI-augmented developer workflows rather than only conventional package distribution or build systems, what CrowdStrike frames as "living off the AI toolchain," abusing the normalised runtime behaviours of AI coding assistants, CI automation and LLM tooling so its actions blend into legitimate developer telemetry (CrowdStrike, 2026-07-21). On install the worm writes unexpected entries into AI coding-assistant configuration files (Claude Desktop, Cursor, VS Code, Windsurf) that register a rogue Model Context Protocol (MCP) tool provider staged in a hidden directory, and it injects hooks under the global git-template hooks path so persistence fires on future git operations. It then harvests credentials from environment variables and .env/SSH-key files (npm tokens, AWS keys, SSH keys, and API keys for multiple LLM providers) fingerprints the host to separate developer workstations from CI runners, and delays full activation 48–96 hours on workstations (immediately on CI) specifically to defeat tools that correlate install-time and behaviour signals, falling back to DNS tunnelling when primary exfiltration is blocked (SecurityBrief, 2026-07-22). The load-bearing defender lesson is CrowdStrike's own candour: of 14 investigated behaviours only 9 produced any signal and only 2 met the fidelity bar for customer-visible alerting, because npm publishes, repo pushes, LLM-API calls, credential handling and file writes overlap heavily with legitimate developer and CI activity (CrowdStrike, 2026-07-21).