Seven AI coding agents run attacker code named in a repository's own .git config
Manifold Security reported eight instances across seven command-line agents. The command runs as the user, outside the sandbox, with no approval prompt, and four were still firing when the researchers retested on September 1.
The Watch · Security desk
What happened
- Manifold Security disclosed eight flaws across seven command-line AI coding agents in which a repository's own Git configuration names a command that the agent then runs on the developer's machine.
- goose, Claude Code and Cursor shipped fixes, while Hermes Agent, Qwen Code, Grok Build and a second Claude Code path were still running repository-supplied commands on Manifold's September 1 retest.
- OpenAI published three CVEs of its own the same day for the identical class in Codex, credited to three unrelated research groups.
Why it matters
- Who's exposed exposure Any workflow that receives a repository as a directory rather than a clone now carries code execution: customer archives, contractor handoffs, restored sync folders, sample repos handed between analysts.
- What it limits constraint The model, prompt policy and tool-approval settings do not intercept this command, so buyers cannot mitigate it with agent configuration and are left waiting on vendor version floors.
- Who has to decide decision Claude Code closed this path once and it reappeared, which means teams have to verify the behaviour per release instead of treating a single advisory as settled.
- What it sets up precedent The same trust-dialog bypass was patched in Visual Studio Code in 2021 and JetBrains IDEs in 2022, so expect the class to keep surfacing wherever a new agent spawns git before it asks anything.
Next story · Science · Sep 23
GitHub will meter every Copilot plan by token consumption from June 1Confirmed2 publishers
core.fsmonitor is a Git performance setting whose value is a command. Git reads it out of the repository's own .git/config and executes it on any operation that refreshes the index, including git status and git diff [9]. Coding agents run exactly those commands in the background at session startup to work out which branch they are on and which files changed, and they leave the repository's configuration in place while doing it [10]. Manifold puts the fault in that subprocess rather than in the model, calling it the ordinary plumbing underneath [12].
Timing is what defeats the controls in each case. On Claude Code and Hermes Agent the payload fires before the workspace-trust prompt is accepted, on Qwen Code before the user has authenticated, and on Grok Build on the first keystroke [8]. OpenAI's record for CVE-2026-19592 describes the result plainly: the helper runs outside the command sandbox and without an approval prompt, and the attacker code can read, change, or delete the user's files and reach other resources the account can reach [7].
In goose, few protections stand between the repository and execution. The goose review command builds its Git invocations with one configuration flag, -c core.quotePath=off, and strips nothing else [16]. GitHub's advisory, which credits Francisco Rosales, says running goose review in a malicious repository runs attacker code with no submitted prompt, no model call, no tool approval and no trust prompt, before goose ever contacts the model [18]. That advisory carries a CVSS 4.0 base score of 7.0, the only score attached to any of these findings [17].
Anthropic already closed this once. Sonar reported the same sink in April and noted that Claude Code 2.0.34 had stopped running git status before the trust dialog was approved, while a related issue persisted [20][21]. Version 2.0.34 shipped November 5, 2025; Manifold found the same startup behavior in 2.1.193, which shipped June 25, 2026 [22]. That is 232 days between the mitigation and the recurrence [25]. Anthropic's June advisory for CVE-2026-55607 had already named git fsmonitor execution during worktree operations [23].
Five of Manifold's eight reports came back as duplicates of findings other researchers had filed independently, one of them on the same day [19]. That is 62.5 percent of the set [24]. OpenAI's three Codex CVEs were credited to three unrelated research groups [6], and Manifold says the pattern is present in more agents than it names [11]. Multiple parties are pulling on the same thread at once, which shortens the window before working code circulates.
What limits this is delivery. The repository has to arrive as files with .git intact, which a shared archive, a shared drive, a sync folder or a USB stick preserves and an ordinary clone does not [3]. Cloning a hostile repository from a remote is not the vector here; the customer-supplied zip and the synced directory are. Current floors are goose 1.44.0 and Codex CLI 0.131.0 [13][14], with Claude Code fixed at 2.1.196 on the core.fsmonitor path and the claude ultrareview path confirmed live on 2.1.252 [15].
What to watch
- Fixes for Hermes Agent, Qwen Code and Grok Build, all listed as pending, and a patch for the claude ultrareview path that was live on 2.1.252.
- Whether Manifold names the additional agents it says carry the same startup pattern but did not detail in GitSpawn.
- Whether any of the seven unscored findings pick up a CVSS assignment, since only goose's CVE-2026-72718 carries one.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence72
- Adoption60
- Hype gap+15
- Incentives55
- Confidence70
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Manifold Security disclosed eight security flaws across seven command-line AI coding agents in which a repository's own Git configuration names a command that the agent runs on the developer's machine, four of them still unpatched at publication.
- [2]
The command executes as the user, outside the agent's sandbox, and without an approval prompt.
- [3]
Exploitation requires the repository to arrive as files with its .git directory intact, which a shared archive, a shared drive, a sync folder or a USB stick preserves, whereas an ordinary clone does not.
- [4]
Fixes have shipped for goose, Claude Code and Cursor.
- [5]
Hermes Agent, Qwen Code, Grok Build and a second path in Claude Code were still executing repository-supplied commands when Manifold retested them on September 1.
- [6]
OpenAI published three CVEs of its own the same day covering the identical class in Codex, credited to three unrelated research groups.
- [7]
OpenAI said in the record for CVE-2026-19592 that the helper runs outside Codex's command sandbox and without a user-approval prompt, allowing attacker-controlled code to run with the user's privileges, and that the code can read, change or delete the user's files and access other resources available to the user's account.
- [8]
On Claude Code and Hermes Agent the payload fires before the workspace-trust prompt is accepted; on Qwen Code before the user has authenticated; on Grok Build on the first keystroke.
- [9]
core.fsmonitor is a Git performance setting whose value is a command that Git runs to identify changed files, and Git reads it from the repository's own .git/config; any operation that refreshes the index, including git status and git diff, executes that command.
- [10]
The agents call those commands in the background to determine which branch they are on and which files have changed, leaving the repository's configuration untouched.
- [11]
Manifold published the findings as GitSpawn, wrote up five of the eight in detail, and said it found the pattern in more agents than it names.
- [12]
Manifold said the vulnerability is not in the model or in anything new, but in the ordinary plumbing underneath, the subprocess an agent spawns at session startup to work out where it is.
- [13]
goose is affected in all versions prior to 1.44.0 and fixed in 1.44.0.
- [14]
Codex CLI is affected in 0.102.0 through 0.130.0 and fixed in 0.131.0.
- [15]
Claude Code was confirmed by Manifold on 2.1.193 and fixed by 2.1.196 on the core.fsmonitor path, with the claude ultrareview path confirmed live on 2.1.252.
- [16]
In goose, the goose review command builds its Git invocations with one configuration flag, -c core.quotePath=off, and strips nothing else.
- [17]
GitHub assigned CVE-2026-72718 a CVSS 4.0 base score of 7.0 in an advisory crediting Francisco Rosales, the only score any of these findings carries.
- [18]
The GitHub advisory said running goose review inside a malicious repo runs attacker code with no submitted prompt, no model call, no tool approval and no trust prompt, and that the command executes before goose ever contacts the model.
- [19]
Five of Manifold's reports came back as duplicates of findings other researchers had filed independently, one of them on the same day.
- [20]
Sonar reported the same sink in April, noted that Anthropic had already moved the startup sequence once to close it, and identified the same trust-dialog bypass in Visual Studio Code before 1.63.1 (CVE-2021-43891) and in JetBrains IDEs before 2021.3.1 (CVE-2022-24346).
- [21]
Sonar said that in version 2.0.34 Claude was updated in a way that mitigated the specific vulnerability by no longer running git status before the user approved the trust dialog, but that a related issue persisted.
- [22]
Version 2.0.34 shipped on November 5, 2025, and Manifold reports the same startup behavior present again in 2.1.193, which shipped on June 25, 2026.
- [23]
Anthropic has previously disclosed pre-trust execution flaws in Claude Code, and its June advisory for CVE-2026-55607 identifies git fsmonitor execution during worktree operations.
- [24]
The five duplicate reports represent 62.5 percent of Manifold's eight reports.
- [25]
232 days elapsed between the Claude Code 2.0.34 mitigation on November 5, 2025 and the 2.1.193 release of June 25, 2026 in which Manifold found the same startup behavior.
Sources
2 independent publishers whose own reporting we read for this story.
- Manifold Security
manifold.security
1 article · September 3, 2026
- thehackernews.comMalicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code
2 articles · September 3, 2026