CLAIM-2026-09-06-03

A repository's own .git/config can set core.fsmonitor to a program, and git executes that program when an index-refreshing command such as git status runs; coding agents issue such commands at session startup.

Why it matters

It tells you the control point. The dangerous call is not a tool invocation the agent decided to make — it is the orientation subprocess it makes before it decides anything.

Sources

• manifoldsec2026gitspawn
• thehackerne2026malicious
• gitproject2026gitconfig