Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code
Malicious .git core.fsmonitor configs let attacker code run in AI coding agents like Claude Code and Codex; four of eight flaws remain unpatched.
Manifold Security disclosed eight flaws across seven command-line AI coding agents where a repository's Git core.fsmonitor configuration causes agent-spawned commands to execute attacker code outside the sandbox and without approval prompts. Fixes shipped for goose (CVE-2026-72718, CVSS 4.0 score 7.0), Claude Code on one path, and Cursor, while Hermes Agent, Qwen Code, Grok Build, and a second Claude Code path were still unpatched as of September 1. OpenAI issued three CVEs for the same class in Codex, including CVE-2026-19592, and prior related bugs include CVE-2021-43891 in Visual Studio Code and CVE-2022-24346 in JetBrains IDEs. Exploitation requires the repository to arrive with its .git directory intact, such as via archives, shared drives, or USB sticks rather than an ordinary clone.
- Git's core.fsmonitor setting in repo .git/config runs a command during index refreshes like git status.
- Payload executes outside agent sandboxes without approval prompts, on some agents before trust or authentication.
- Fixes shipped for goose 1.44.0, Claude Code 2.1.196, and Cursor; Hermes, Qwen Code, Grok Build pending.
- OpenAI published three CVEs for Codex, including CVE-2026-19592, crediting three unrelated research groups.
- Exploitation requires repos delivered with .git directory intact, such as archives, shared drives, or USB sticks.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-43891 | Visual Studio Code Remote Code Execution Vulnerability | 7.8 | 13% | ||
| CVE-2022-24346 | In JetBrains IntelliJ IDEA before 2021.3.1, local code execution via RLO (Right-to-Left Override) characters was possible | 7.8 | <1% | ||
| CVE-2026-19592 | Unsandboxed attacker code execution in OpenAI Codex via malicious Git core.fsmonitor | 7.3 | <1% | ||
| CVE-2026-55607 | Claude Code: Claude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox… | 7.7 | <1% | ||
| CVE-2026-71963 | Command injection RCE in Hermes Agent via malicious .git/config | 8.6 | <1% | PoC | |
| CVE-2026-72718 | goose is general-purpose AI agent that runs on your machine | 7.0 | <1% |
From the original article
5 min read at thehackernews.com
Manifold Security has disclosed eight security flaws across seven command-line AI coding agents in which a repository's own Git configuration names a command that the agent runs on the developer's machine, four of them still unpatched at publication. The command executes as the user, outside the agent's sandbox and without an approval prompt, and exploitation requires the repository to arrive
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.