Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code
Malicious .git core.fsmonitor configs let attacker code run in AI coding agents like Claude Code and Codex; four of eight flaws remain unpatched.
Manifold Security disclosed eight flaws across seven command-line AI coding agents where a repository's Git core.fsmonitor configuration causes agent-spawned commands to execute attacker code outside the sandbox and without approval prompts. Fixes shipped for goose (CVE-2026-72718, CVSS 4.0 score 7.0), Claude Code on one path, and Cursor, while Hermes Agent, Qwen Code, Grok Build, and a second Claude Code path were still unpatched as of September 1. OpenAI issued three CVEs for the same class in Codex, including CVE-2026-19592, and prior related bugs include CVE-2021-43891 in Visual Studio Code and CVE-2022-24346 in JetBrains IDEs. Exploitation requires the repository to arrive with its .git directory intact, such as via archives, shared drives, or USB sticks rather than an ordinary clone.
- Git's core.fsmonitor setting in repo .git/config runs a command during index refreshes like git status.
- Payload executes outside agent sandboxes without approval prompts, on some agents before trust or authentication.
- Fixes shipped for goose 1.44.0, Claude Code 2.1.196, and Cursor; Hermes, Qwen Code, Grok Build pending.
- OpenAI published three CVEs for Codex, including CVE-2026-19592, crediting three unrelated research groups.
- Exploitation requires repos delivered with .git directory intact, such as archives, shared drives, or USB sticks.
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-43891 | Visual Studio Code Remote Code Execution Vulnerability Visual Studio Code Remote Code Execution Vulnerability NVD description · AI analysis pending | 7.8 | 13% |
| — | ||
| CVE-2022-24346 | In JetBrains IntelliJ IDEA before 2021.3.1, local code execution via RLO (Right-to-Left Override) characters was possible. In JetBrains IntelliJ IDEA before 2021.3.1, local code execution via RLO (Right-to-Left Override) characters was possible. NVD description · AI analysis pending | 7.8 | <1% |
| — | ||
| CVE-2026-19592 | Unsandboxed attacker code execution in OpenAI Codex via malicious Git core.fsmonitor OpenAI Codex CLI and Codex Desktop automatically collect Git repository metadata without disabling the repository-local core.fsmonitor setting, so Git can execute the filesystem-monitor helper named in a repository's .git/config while Codex gathers that metadata. The flaw is triggered when a user opens or works in a repository prepared by an attacker and delivered with its .git/config intact, such as a copied folder or archive, because an ordinary Git clone does not preserve the source repository's local config. The attacker-supplied helper runs outside Codex's command sandbox and without any user-approval prompt, giving the attacker code execution with the user's privileges, including the ability to read, modify, or delete the user's files and access other resources available to that account. Anyone running Codex CLI on Windows, macOS, or Linux or Codex Desktop on Windows or macOS who opens untrusted repositories is exposed, and related reporting indicates the same malicious .git/config pattern also affects other AI coding agents such as Claude and Cursor, although this CVE is scoped to Codex. No exploitation is currently known: there is no public proof-of-concept, EPSS is a low 0.1%, the issue is not in CISA KEV, and it was disclosed through Pwn2Own as ZDI-26-650. Do: Update Codex CLI and Codex Desktop to the latest available release containing the fix as soon as it is published (no specific fixed version number is provided in the available data). Until updating, avoid opening untrusted repositories delivered with their .git/config intact, and inspect .git/config for a core.fsmonitor entry pointing at an unknown or attacker-supplied helper before working in such a repository with Codex. Note that a plain git clone from a remote does not preserve the malicious local config, so archives, copied directories, and dotfile restoration are the delivery paths to watch. | 7.3 | <1% |
| largeon the order of hundreds of thousands of developers running Codex CLI or Codex Desktop (estimate; no official install counts available) | ||
| CVE-2026-55607 | Claude Code is an agentic coding tool. Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. By exploiting symlink manipulation and git fsmonitor execution during worktree operations, an attacker could overwrite files in the user's home directory (such as .zshenv), leading to code execution outside of seatbelt sandbox restrictions. Reliably exploiting this required the user to clone a malicious repository containing prompt injection content and run Claude Code against it. This vulnerability is fixed in 2.1.163. NVD description · AI analysis pending | 7.7 | <1% |
| — | ||
| CVE-2026-71963 | Command injection RCE in Hermes Agent via malicious .git/config Hermes Agent versions 0.18.2 through 0.21.0 contain an OS command injection flaw (CWE-78) in which the agent's git operations honor the core.fsmonitor setting in a repository's .git/config, letting that setting specify an attacker-controlled command. The attack is triggered when a user opens a crafted repository and sends any message, at which point the agent runs a git status index refresh that executes the injected command in the user's process context. A successful attacker gains arbitrary OS command execution with access to the user's full environment, including configured AI provider API keys, which can be exfiltrated. Anyone running an affected Hermes Agent version who opens untrusted or attacker-supplied repositories is exposed; the attack requires user interaction but no privileges or authentication on the target. No public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation is currently known, and EPSS estimates roughly a 0.9% probability of exploitation within 30 days. Do: Upgrade Hermes Agent to a release that includes fix commit f6234d0 (i.e., any version newer than 0.21.0) and until then avoid opening untrusted repositories with the agent, or inspect their .git/config for a core.fsmonitor entry before use. Users who opened untrusted repositories while running a vulnerable version should rotate the AI provider API keys present in their environment. | 8.6 | <1% |
| unknown - no public install or user counts exist for Hermes Agent; the population is plausibly small, as it is a niche developer tool rather than a mainstream… | ||
| CVE-2026-72718 | goose is general-purpose AI agent that runs on your machine. goose is general-purpose AI agent that runs on your machine. Prior to 1.44.0, the `goose review` command runs the system `git` executable to gather the diff for review without stripping attacker-controlled Git configuration. A malicious repository whose `.git/config` sets [`core] fsmonitor = ` causes Git to execute that command on the host during the index refresh performed by `git diff HEAD`. The command runs before goose contacts a model and without a submitted prompt, model call, tool approval, or trust prompt. The context-gathering Git process is not sandboxed and is outside goose's tool-permission model. Arbitrary commands run with the privileges and environment of the user running goose, allowing file access or modification and exfiltration of environment secrets and provider API keys. The vulnerable Git invocations are built by git_command() in crates/goose-cli/src/commands/review/handler.rs and are used by touched_files() and collect_diff() for `git diff --name-only HEAD` and `git diff HEAD`. This issue is fixed in version 1.44.0. NVD description · AI analysis pending | 7.0 | <1% | — | — |
Full article1,203 words · extracted from thehackernews.com · click to collapse
Manifold Security has disclosed eight security flaws across seven command-line AI coding agents in which a repository's own Git configuration names a command that the agent runs on the developer's machine, four of them still unpatched at publication.
The command executes as the user, outside the agent's sandbox and without an approval prompt, and exploitation requires the repository to arrive as files with its .git directory intact, which a shared archive, a shared drive, a sync folder, or a USB stick preserves, whereas an ordinary clone does not.
Fixes have shipped for goose, Claude Code, and Cursor, while Hermes Agent, Qwen Code, Grok Build, and a second path in Claude Code were still executing repository-supplied commands when Manifold retested them on September 1.
OpenAI published three CVEs of its own the same day covering the identical class in Codex, credited to three unrelated research groups.
"The helper runs outside Codex's command sandbox and without a user-approval prompt, allowing attacker-controlled code to run with the user's privileges. The code can read, change, or delete the user's files and access other resources available to the user's account," OpenAI said in the record for CVE-2026-19592 .
On Claude Code and Hermes Agent, the payload fires before the workspace-trust prompt is accepted; on Qwen Code, before the user has authenticated; and on Grok Build, on the first keystroke.
core.fsmonitor is a Git performance setting whose value is a command that Git runs to identify changed files, and Git reads it from the repository's own .git/config. Any operation that refreshes the index, including git status and git diff, executes that command.
The agents call those commands in the background to determine which branch they are on and which files have changed, leaving the repository's configuration untouched.
Manifold, which published the findings as GitSpawn , wrote up five of the eight in detail and said it found the pattern in more agents than it names.
"The vulnerability is not in the model, or in anything new. It is in the ordinary plumbing underneath, the subprocess an agent spawns at session startup to work out where it is," Manifold said.
The following agents and versions are affected -
goose - All versions prior to 1.44.0, fixed in 1.44.0
Codex CLI - 0.102.0 through 0.130.0, fixed in 0.131.0
Codex Desktop for macOS - 260202.0859 through 26.513.31313, fixed in 26.519.22136
Codex Desktop for Windows - 26.304.38 through 26.513.40821, fixed in 26.519.21041, and Microsoft Store package 26.304.38.0 through 26.513.4821.0, fixed in 26.519.2081.0
Claude Code - Confirmed by Manifold on 2.1.193 and fixed by 2.1.196 on the core.fsmonitor path, with the claude ultrareview path confirmed live on 2.1.252
Hermes Agent - 0.18.2 and 0.21.0 confirmed by Manifold, fix pending
Qwen Code - 0.19.6 and 0.22.3 confirmed by Manifold, fix pending
Grok Build - 0.2.93 and 1.0.13 confirmed by Manifold, fix pending
In goose, the goose review command builds its Git invocations with one configuration flag, -c core.quotePath=off, and strips nothing else.
GitHub assigned CVE-2026-72718 a CVSS 4.0 base score of 7.0 in an advisory crediting Francisco Rosales , the only score any of these findings carries.
"So running goose review inside a malicious repo runs attacker code - no submitted prompt, no model call, no tool approval, no trust prompt. The command executes before goose ever contacts the model," the advisory said.
Sonar reported the same sink in April , noted that Anthropic had already moved the startup sequence once to close it, and identified the same trust-dialog bypass in Visual Studio Code before 1.63.1 ( CVE-2021-43891 ) and in JetBrains IDEs before 2021.3.1 ( CVE-2022-24346 ).
"In version 2.0.34, Claude was updated in a way that mitigated the specific vulnerability by no longer running git status before the user approved the trust dialog. However, a related issue persisted," Sonar said.
Version 2.0.34 shipped on November 5, 2025, and Manifold reports the same startup behavior present again in 2.1.193, which shipped on June 25, 2026.
Anthropic has previously disclosed pre-trust execution flaws in Claude Code, and its June advisory for CVE-2026-55607 identifies git fsmonitor execution during worktree operations.
What Is Still Unpatched
Five of Manifold's reports came back as duplicates of findings other researchers had filed independently, one of them on the same day.
The researchers reported the Claude Code core.fsmonitor finding on June 26 and says it was fixed by 2.1.196 on June 29. The report was closed as a duplicate of one filed earlier that day, Manifold said.
Anthropic published no advisory for it, and The Hacker News confirmed on September 2 that the vendor's published advisory record for the npm package covers neither of the Claude Code findings.
The second Claude Code path, reached through claude ultrareview, turns on a different Git configuration key that Manifold has withheld. At the same time, the issue is live, and Manifold confirmed it on 2.1.252 on September 1, against the current release 2.1.258. No source states whether the subsequent releases have closed it.
Alibaba's security response centre accepted the Qwen Code report on July 7. The Hacker News confirmed via the npm registry on September 2 that 0.22.3, the version Manifold re-tested, is the latest published release.
Nous Research's Hermes Agent, which an operator ran unattended in an intrusion against a Thai government network in July, drew six contact attempts across five channels and left the private advisory untriaged, Manifold said.
VulnCheck assigned CVE-2026-71963 , according to Manifold. The Hacker News found no published record for that identifier in MITRE's CVE List on September 2, where the identifiers either side of it are published VulnCheck records.
xAI closed an earlier report of the same class as informative on July 1. It closed Manifold's July 14 report as a duplicate of that one.
Separate research on the same 0.2.93 build found Grok Build uploading whole Git repositories to xAI storage, which the company addressed on X rather than through an advisory.
Manifold documented the same class in Cursor CLI three weeks earlier, where a repository-supplied setup command ran before the workspace-trust prompt and outside the sandbox.
No source reports exploitation of any of these findings. The Hacker News checked the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog on September 2, version 2026.09.01, with 1,687 entries, and found none of the CVEs listed.
"FSMonitor abuse exploits a legitimate feature, not a bug. It leverages the intersection of Git's flexibility and the automation of modern IDEs to turn a repository open event into code execution," Cobalt said in a red-team writeup in December .
Users are advised to perform the following checks -
Inspect .git/config before opening a received directory with an agent, looking for core.fsmonitor, core.hooksPath, and attr.tree alongside a clean or process filter
Run git config --get core.fsmonitor inside any repository that arrived as files
Run git config --global --list | grep fsmonitor to audit the global configuration
Set git config --global core.fsmonitor false to disable the setting by default
Vendors shipping agents strip the configuration on background calls, for example git -c core.fsmonitor=false status
Codex CLI's current release is 0.152.1 as of September 2, so installations pinned below 0.131.0 remain exposed.
Found this article interesting? Follow us on Google News , Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/09/malicious-git-configs-can-make-claude.html