A shared folder can run code before your AI agent asks
A repository folder shared as a .zip or synced folder can carry a Git setting that several AI coding agents ran before any prompt. What was fixed, who is exposed, and what to check.
On 1 September 2026, Manifold Security published GitSpawn. A repository's own Git configuration names a command, and several command-line AI coding agents ran that command on the developer's machine before any approval prompt. OpenAI published CVE-2026-19592 for the same class of flaw in Codex the same day.
How it works
Agents run Git in the background to learn about your project, often git status or git diff. Some do it before you type a prompt or accept the workspace trust prompt. Git reads settings from the repository's own .git/config. One of them, core.fsmonitor, can name a program, and Git runs that program when it refreshes its index.
So the folder decides what runs. The program runs as you, outside the agent's sandbox, with no prompt.
Who is exposed
An ordinary git clone does not copy a repository's .git/config, so a cloned repository cannot do this. The risk is a project that arrives as a folder with its .git directory inside: a shared .zip, a shared drive, a sync folder or a USB stick. Manifold used a .zip for every proof of concept.
What was fixed, as reported
Claude Code: confirmed in 2.1.193 and fixed by 2.1.196, according to Manifold.
Codex CLI: versions 0.102.0 through 0.130.0 are affected and 0.131.0 is not, according to the CVE record.
goose: 1.41.0 was affected and 1.44.0 has the fix, according to Manifold.
Manifold reported Hermes Agent, Qwen Code and Grok Build still unpatched when it retested on 1 September. It also reported a second Claude Code path through claude ultrareview, using a Git setting it did not name. We have not verified the current status of these. Check each project's release notes before you rely on them.
What to do
Update your agent to a fixed release.
Before you open a folder that did not come from git clone, read its .git/config. Reading the file runs nothing. Running Git or an agent inside the folder can.
cat .git/config
grep -nE 'fsmonitor|sshCommand|hooksPath|filter|editor|pager' .git/configTreat any line whose value is a command or a path to a program as a warning sign. If you are unsure, clone the project fresh from its source and copy over only the files you changed.
The same folder carries agent settings
A folder that arrives this way also brings the project's agent settings, such as .mcp.json, .claude/settings.json and .claude/settings.local.json. Claude Code's documentation says it applies allow rules from settings.local.json without the workspace trust step while that file is untracked. Read these files as well.
What to look for in those files: https://deepsweep.ai/blog/mcp-security-best-practices
And what your agent can do without asking: https://deepsweep.ai/blog/ai-coding-agent-auto-approve-settings
Sources
https://www.manifold.security/blog/ai-coding-agents-git-hijack
https://www.cve.org/CVERecord?id=CVE-2026-19592
https://thehackernews.com/2026/09/malicious-git-configs-can-make-claude.html