The harness's own git ran repository code before the trust prompt
Manifold Security (2026-09-01): seven agents run git to orient themselves at startup, and a repository's .git/config can set core.fsmonitor to a command git then runs as the user, outside any sandbox, before or without a prompt. Hermes fixed it in v2026.9.7 (commit f6234d00, GHSA-7x36, not yet published); every tag through v2026.8.31 is exposed. Manifold reports a second Claude Code path still reproducing on 2.1.252, and no changelog line through 2.1.278 names a fix. Codex 0.154.0 stopped running workspace helpers before a project is trusted.
What this changes for operators
- Upgrade Hermes to v2026.9.7 or later. Open untrusted repositories only inside a container or VM; the trust prompt appears after the harness’s own git has run.
- Before opening a repo you did not create, check .git/config for command-valued keys such as core.fsmonitor and core.hooksPath.
- Evidence that would settle residual: a Claude Code changelog line or advisory for the second path, and Grok Build’s status (unpatched at 1.0.13 per Manifold).
Primary sources
- commit 2026-09-21-hermes-agent-ghsa-7x36-8jrh-v4pw-a-copied-repo-s-git-config-could-run-code-on-the-host-before-any-promp github.com/NousResearch/hermes-agent/commit/f6234d00c5d59450adea1d7edd30ad3859375c79
- third_party_research 2026-09-21-claude-code-gitspawn-ultrareview-path-ran-repo-git-config-before-trust-no-fix-named-through-2-1-278 www.manifold.security/blog/ai-coding-agents-git-hijack
- tagged_commit_file 2026-09-21-claude-code-gitspawn-ultrareview-path-ran-repo-git-config-before-trust-no-fix-named-through-2-1-278 anthropics/claude-code / CHANGELOG.md
- github_release 2026-09-21-codex-untrusted-projects-stop-feeding-agents-md-and-startup-stops-running-workspace-helpers-befo openai/codex / rust-v0.150.0
- github_release 2026-09-21-codex-untrusted-projects-stop-feeding-agents-md-and-startup-stops-running-workspace-helpers-befo openai/codex / rust-v0.154.0
- merged_pr 2026-09-21-codex-untrusted-projects-stop-feeding-agents-md-and-startup-stops-running-workspace-helpers-befo github.com/openai/codex/pull/39837
Signal metadata
Source findings
- 2026-09-21-hermes-agent-ghsa-7x36-8jrh-v4pw-a-copied-repo-s-git-config-could-run-code-on-the-host-before-any-promp 2026-09-21-hermes-agent-ghsa-7x36-8jrh-v4pw-a-copied-repo-s-git-config-could-run-code-on-the-host-before-any-promp
- 2026-09-21-claude-code-gitspawn-ultrareview-path-ran-repo-git-config-before-trust-no-fix-named-through-2-1-278 2026-09-21-claude-code-gitspawn-ultrareview-path-ran-repo-git-config-before-trust-no-fix-named-through-2-1-278
- 2026-09-21-codex-untrusted-projects-stop-feeding-agents-md-and-startup-stops-running-workspace-helpers-befo 2026-09-21-codex-untrusted-projects-stop-feeding-agents-md-and-startup-stops-running-workspace-helpers-befo
Featured in
- Before the First Turn / 2026-09-21
Run: 2026-09-21-weekly-digest-2026-08-20_2026-09-21-frontier-v0
Schema: bitter.frontier_signals.v0 / ID: 2026-09-21-gitspawn-the-harness-ran-git-before-trust
Research evidence and publication history are open in the repository.