GitSpawn: a repository's own .git/config runs attacker commands when coding agents gather git context at startup, before the trust prompt

users of seven coding agents who open a directory that arrived with its .git folder intact (zip, shared drive, sync folder, USB) rather than by cloning; Claude Code 2.1.193 and the ultrareview path in 2.1.210-2.1.252, Codex CLI 0.102.0-0.130.0, goose 1.41.0, Hermes Agent 0.18.2-0.21.0, Qwen Code 0.19.6-0.22.3, Grok Build 0.2.93-1.0.13

Manifold Security (Francisco Rosales), page dated 2026-09-01; The Hacker News coverage dated 2026-09-02. Mechanism: agents run git status / git diff as an internal subprocess at session start to work out where they are; git honours the repository's own .git/config, so a key such as core.fsmonitor executes as the user, outside the sandbox and before the workspace-trust prompt. The vector is any transfer that preserves .git (zip, shared drive, sync folder, USB), not a clone, since clone does not copy config. Coordinated advisory across seven agents, so one record. CVE attribution: CVE-2026-72718 (goose) and CVE-2026-71963 (Hermes Agent) are on the Manifold page; CVE-2026-19592 (Codex CLI 0.102.0-0.130.0, fixed 0.131.0) and the Claude Code version range come from THN, since Manifold only says Codex and Cursor were affected, reported, closed as duplicates of another researcher's reports, and since patched. The lead's attribution of CVE-2026-55607 to this disclosure is NOT supported by either cited page and that CVE is already AIR-2026-0140 (Claude Code worktree path confusion, fixed 2.1.163), whose chain also used fsmonitor execution; related but distinct advisory. THN also notes Claude Code 2.0.34 had earlier stopped running git status before the trust dialog, and that the ultrareview path uses a different git setting of the same kind. Vendor handling recorded by Manifold: Anthropic closed both reports as duplicates; xAI closed Grok Build as informative twice; Alibaba accepted Qwen Code without patching; Nous Research did not triage after six contacts. autonomy_level=assistant because no delegated task or model decision is involved, the trigger is startup plumbing; ambiguity noted. Added 2026-09-21: CVE-2026-19593 (OpenAI-assigned, reporter Satoki Tsuji / Ikotas Labs, published 2026-09-01) is Codex Desktop's instance of this class: opening a workspace auto-inspects Git metadata and an attacker-controlled .git/config using attr.tree and clean/process filters runs a program outside the sandbox with no trust prompt; Manifold notes its own Codex report was closed as a duplicate of another researcher's. Held here so each CVE lives in one record; the unrelated Codex PowerShell approval bypass CVE-2026-19591 is its own record.