Correction · October 13, 2026
The report confirms the Claude startup flaw on version 2.1.193, rather than every earlier version. Its ultrareview finding uses a different Git setting from core.fsmonitor, so checking that one key does not cover every reported variant. Reported startup commands bypassed the agents' task sandbox; isolation of the entire process is a separate control.

What happened

Coding agents like Claude Code run background checks on a project the moment you open it, using git, the tool that tracks changes in a coding project. Manifold Security found that some agents passed untrusted project configuration into those checks. They call it GitSpawn, and it lets a project folder run its own code automatically, before you have approved anything and sometimes before you have even signed in.

Here is the mechanism. To understand a project, agents fire routine git commands like git status the instant you open a folder. That command makes git refresh its internal list of what files exist, called the index. During that refresh, git checks a project setting named core.fsmonitor. It is meant to speed up huge projects: instead of scanning every file, git asks a helper program what changed.

Git reads that setting from a plain text file the project itself ships, called .git/config. Whoever built the project controls that file. If it names a command in the fsmonitor setting, git runs that command on your computer, with your permissions, the instant your agent checks the project’s status. Nothing appears on screen, and there is no approval prompt.

This does not happen when you copy a project the normal way, using git clone to pull it straight from GitHub. The trap only works if the project arrives as a folder with its hidden .git directory already inside. That happens with a zipped file, a shared drive, a synced folder, or a USB stick. It is a common way to receive a project: a contractor’s handoff, a class assignment, or a colleague passing you their copy instead of a repository link.

Manifold Security tested several agents and found the same mistake repeated one by one:

  • Claude Code had two separate variants. Opening a folder triggered the flaw in the researchers’ test of version 2.1.193, and Anthropic fixed that one in 2.1.196. A second version was triggered by Claude Code’s own ultrareview command, which runs an automated review of a repository. It was still unpatched as of version 2.1.252 on September 1, when the report published.
  • Goose, an open-source agent, was fixed in version 1.44.0.
  • Hermes, Qwen Code, and Grok Build had no fix available as of publication.
  • OpenAI’s Codex and Cursor were also affected, Manifold Security added in an update after publishing. Both had already been patched by the time the researchers confirmed the reports.

Claude Code alone logs more than 77 million downloads a month on npm, the registry that distributes JavaScript-based command-line tools. Across the agents in the report, combined GitHub star counts, a rough measure of how many developers follow a project, run past 480,000.

Why it matters

The affected products made context-gathering Git calls without neutralizing settings supplied by the copied project. Those calls could execute a configured program before the agent’s approval system saw a task.

The failure point sits before the safety net most builders already lean on. Claude Code and similar tools show a one-time workspace trust prompt the first time you open a new folder. It exists to make you pause before the agent touches anything unfamiliar. GitSpawn runs before that prompt appears, in some cases before you have even signed into the tool.

The reported startup commands ran outside the agents’ task sandbox, bypassing that layer. A separately isolated machine or container that contains the whole agent process can still limit its reach.

Who should care

Anyone who opens a project they did not create themselves inside Claude Code, Codex, Cursor, Goose, Hermes, Qwen Code, or Grok Build. That includes freelancers receiving a client’s codebase as a zip file, students opening a classmate’s assignment, or anyone pulling a project off a shared drive instead of cloning it from GitHub. If you only ever open projects you started from scratch, your exposure is much lower. A colleague zipping up a shared project and handing it to you still counts as a foreign source, though.

What builders should do next

Before opening a project you did not create in your coding agent, especially one you received as a zip file, from a shared drive, or over USB, check its git settings first. Open a terminal, move into the project folder, and run:

git config --get core.fsmonitor

This asks git to print out that one setting for the project without triggering the risky part. If it prints a command you do not recognize, inspect it before opening the folder. A value can also refer to Git’s built-in monitoring, so output alone does not establish malicious execution.

Read .git/config in a plain text editor for other settings that name executable programs. The ultrareview variant uses a different setting, so a clear core.fsmonitor value alone does not establish safety.

Update your agent, too. Claude Code users should be on version 2.1.196 or later to close the first hole Manifold Security found. The ultrareview command remained unpatched in Claude Code 2.1.252 on September 1, 2026, so avoid running it against a project you do not already trust until Anthropic confirms a fix.

GitSpawn is a reminder that a coding agent’s context-gathering step is still code running on your machine, with your permissions, even when nothing you did looks like running code. Check a project’s .git/config before opening it in an agent, because context checks run with your account’s permissions.

End of article