Manifold Security has disclosed eight security flaws across seven command-line AI coding agents in which a repository’s own Git configuration names a command that the agent runs on the developer’s machine, four of them still unpatched at publication. The command executes as the user, outside the agent’s sandbox and without an approval prompt, and exploitation requires the repository to arrive as files with its .git directory intact, which a shared archive, a shared drive, a sync folder, or a USB stick preserves, whereas an ordinary clone does not. Fixes have shipped for goose, Claude Code, and Cursor, while Hermes Agent, Qwen Code, Grok Build, and a second path in Claude Code were still executing repository-supplied commands when Manifold retested them on September 1. OpenAI published three CVEs of its own the same day covering the identical class in Codex, credited to three unrelated research groups.
How a Git Performance Setting Becomes an Attack Vector
At the center of these vulnerabilities is core.fsmonitor, a Git performance setting whose value is a command that Git runs to identify changed files. Git reads it from the repository’s own .git/config. Any operation that refreshes the index, including git status and git diff, executes that command. The AI coding agents call those commands in the background to determine which branch they are on and which files have changed, leaving the repository’s configuration untouched. Exploitation is straightforward: an attacker places a malicious .git/config inside a repository that arrives as a tarball, Zip archive, shared folder, or USB drive. When the agent opens the repository and triggers a Git status call, the attacker’s command runs with the user’s privileges.
Manifold, which published the findings as GitSpawn, wrote up five of the eight in detail and said it found the pattern in more agents than it names. “The vulnerability is not in the model, or in anything new. It is in the ordinary plumbing underneath, the subprocess an agent spawns at session startup to work out where it is,” the firm said. On Claude Code and Hermes Agent, the payload fires before the workspace-trust prompt is accepted; on Qwen Code, before the user has authenticated; and on Grok Build, on the first keystroke.
What Is core.fsmonitor and Why Does It Enable Code Execution?
Core.fsmonitor is a Git configuration option that allows a repository to specify an external program to monitor the filesystem for changes. When Git runs an operation that needs to update its index, it executes the command defined in core.fsmonitor. Because the value is read directly from the repository’s own Git configuration, an attacker can embed any command there. The AI coding agents, in their normal operation, invoke Git commands such as git status or git diff without stripping this configuration. The command then executes on the developer’s machine, outside any sandbox, with the full privileges of the user running the agent.
OpenAI’s advisory for Codex under CVE-2026-19592 states: “The helper runs outside Codex’s command sandbox and without a user-approval prompt, allowing attacker-controlled code to run with the user’s privileges. The code can read, change, or delete the user’s files and access other resources available to the user’s account.”
Affected AI Coding Agents and Patch Status
Manifold Security tested each agent and confirmed the vulnerability. The following versions are affected, with fixes applied only to some as of September 1, 2026:
- goose – All versions prior to 1.44.0, fixed in 1.44.0
- Codex CLI – 0.102.0 through 0.130.0, fixed in 0.131.0
- Codex Desktop for macOS – 260202.0859 through 26.513.31313, fixed in 26.519.22136
- Codex Desktop for Windows – 26.304.38 through 26.513.40821, fixed in 26.519.21041; Microsoft Store package 26.304.38.0 through 26.513.4821.0, fixed in 26.519.2081.0
- Claude Code – Confirmed by Manifold on version 2.1.193 and fixed by 2.1.196 on the core.fsmonitor path; a second path through claude ultrareview confirmed live on 2.1.252
- Hermes Agent – Versions 0.18.2 and 0.21.0 confirmed by Manifold; fix pending
- Qwen Code – Versions 0.19.6 and 0.22.3 confirmed by Manifold; fix pending
- Grok Build – Versions 0.2.93 and 1.0.13 confirmed by Manifold; fix pending
In goose, the goose review command builds its Git invocations with one configuration flag, -c core.quotePath=off, and strips nothing else. GitHub assigned CVE-2026-72718 a CVSS 4.0 base score of 7.0 in an advisory crediting Francisco Rosales, the only score any of these findings carries. “So running goose review inside a malicious repo runs attacker code – no submitted prompt, no model call, no tool approval, no trust prompt. The command executes before goose ever contacts the model,” the advisory said.
Why the Vulnerability Persists Despite Previous Fixes
Sonar reported the same sink in April 2026, noting that Anthropic had already moved the startup sequence once to close it. Sonar identified the same trust-dialog bypass in Visual Studio Code before version 1.63.1 (CVE-2021-43891) and in JetBrains IDEs before 2021.3.1 (CVE-2022-24346). “In version 2.0.34, Claude was updated in a way that mitigated the specific vulnerability by no longer running git status before the user approved the trust dialog. However, a related issue persisted,” Sonar said. Version 2.0.34 shipped on November 5, 2025, and Manifold reports the same startup behavior present again in 2.1.193, which shipped on June 25, 2026. Anthropic has previously disclosed pre-trust execution flaws in Claude Code, and its June advisory for CVE-2026-55607 identifies git fsmonitor execution during worktree operations.
The recurrence indicates that the underlying pattern – agents running Git commands that honor repository-supplied configuration – is difficult to eliminate entirely. Each agent’s codebase handles Git invocation differently, and a single missed parameter can reopen the attack path. Manifold noted that the Claude Code core.fsmonitor finding was reported on June 26 and fixed by version 2.1.196 on June 29; the report was closed as a duplicate of one filed earlier that same day. Anthropic published no advisory for it, and confirmation on September 2 found that the vendor’s published advisory record for the npm package covers neither of the Claude Code findings.
What Remains Unpatched: Hermes, Qwen, Grok, and a Second Claude Code Path
Five of Manifold’s reports came back as duplicates of findings other researchers had filed independently, one of them on the same day. The second Claude Code path, reached through claude ultrareview, turns on a different Git configuration key that Manifold has withheld. At the same time, the issue is live, and Manifold confirmed it on version 2.1.252 on September 1, against the current release 2.1.258. No source states whether subsequent releases have closed it.
Alibaba’s security response centre accepted the Qwen Code report on July 7. Confirmation via the npm registry on September 2 showed that version 0.22.3, the version Manifold re-tested, is the latest published release. Nous Research’s Hermes Agent, which an operator ran unattended in an intrusion against a Thai government network in July, drew six contact attempts across five channels and left the private advisory untriaged, Manifold said. VulnCheck assigned CVE-2026-71963, according to Manifold, but no published record for that identifier appeared in MITRE’s CVE List as of September 2; identifiers on either side are published VulnCheck records.
xAI closed an earlier report of the same class as informative on July 1, then closed Manifold’s July 14 report as a duplicate of that one. Separate research on the same 0.2.93 build of Grok Build found it uploading whole Git repositories to xAI storage, which the company addressed on X rather than through an advisory. Manifold documented the same class in Cursor CLI three weeks earlier, where a repository-supplied setup command ran before the workspace-trust prompt and outside the sandbox.
No Known Exploitation but Clear Warning Signs
No source reports exploitation of any of these findings. Checking the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog on September 2, version 2026.09.01, with 1,687 entries, showed none of the CVEs listed. However, the technique is not new: “FSMonitor abuse exploits a legitimate feature, not a bug. It leverages the intersection of Git’s flexibility and the automation of modern IDEs to turn a repository open event into code execution,” Cobalt said in a red-team writeup in December 2025. The fact that multiple independent research groups – Manifold, OpenAI’s own bounty program, Sonar, and others – converged on the same attack within months underscores how pervasive the issue has become.
Mitigation Guidance for Developers and Organizations
Users are advised to perform the following checks before opening any received directory with an AI coding agent:
- Inspect .git/config for the presence of core.fsmonitor, core.hooksPath, and attr.tree alongside a clean or process filter.
- Run git config –get core.fsmonitor inside any repository that arrived as files, not through a standard clone.
- Run git config –global –list | grep fsmonitor to audit the global configuration for unexpected settings.
- Set git config –global core.fsmonitor false to disable the setting by default, overriding any repository-specific value.
- Vendors shipping agents should strip the configuration on background calls, for example by using git -c core.fsmonitor=false status.
Codex CLI’s current release is 0.152.1 as of September 2, so installations pinned below 0.131.0 remain exposed. For organizations that rely on AI coding agents in development workflows, the practical risk is highest when repositories are exchanged via archives, USB drives, or shared network drives – exactly the channels that preserve a repository’s .git directory intact. A single malicious repository from a contractor, a third-party dependency archive, or even a coworker’s shared folder can trigger code execution before the developer has any opportunity to approve it.
The Git configuration attack against AI agents illustrates a broader lesson: as software development tools incorporate LLMs and automated assistants, the trusted but unexamined plumbing beneath them becomes a high-value target. Developers who once manually typed Git commands could afford to inspect repositories before opening them; an agent that automatically runs git status on startup removes that human step. The responsibility shifts to the tool vendors to sanitize every Git invocation, or to users to disable the vulnerable configuration globally. Neither approach is foolproof, but the stakes are clear: an attacker who can place a file on a developer’s filesystem can now, through a configuration value, hijack the very agent meant to help write secure code.
