Malicious .git Configs Can Make Claude Code, Codex, and Cursor Run Attacker Code

Opening a repository you did not create can now run someone else’s command on your machine, if you point an AI coding agent at it. On September 2, 2026, the security firm Manifold Security disclosed eight security flaws across seven command-line AI coding agents in which a received repository’s own .git config names a command that the agent runs automatically on the developer’s machine, with no prompt typed and no approval clicked, as The Hacker News reported. Four of the eight were still unpatched when the research went public.

The affected tools are the ones a lot of engineers now keep open all day: Claude Code, OpenAI’s Codex, Cursor, Nous Research’s Hermes Agent, and three more Manifold named. The attacker-supplied command runs as the logged-in user, outside the agent’s sandbox, and it fires during routine startup work the agent does before you have typed anything. That is the whole story in one line, and it is worth sitting with: the command does not need you to run it. The agent runs it for you.

How a Repository Runs Its Own Command

The mechanism abuses ordinary Git behavior, not a bug in Git. Git has a long-standing performance setting, core.fsmonitor, whose value is a command that Git executes to find out which files changed, and Git reads that value from a repository’s own .git config. Any everyday operation that refreshes the index, such as git status or git diff, runs it.

AI coding agents call those same commands in the background at session startup, to work out which branch they are on and which files have changed. If a repository ships its own configuration, the agent inherits it. So a booby-trapped repo can name a command, the agent runs a normal status check inside it, and the command executes with the user’s full privileges, outside whatever permission system the agent advertises. Manifold published the class of findings under the name GitSpawn and said it found the pattern in more agents than it names.

Its framing is the part defenders should internalize. “The vulnerability is not in the model, or in anything new. It is in the ordinary plumbing underneath, the subprocess an agent spawns at session startup to work out where it is,” the company wrote.

The timing is what makes it dangerous. On Claude Code and Hermes Agent, Manifold says the command fires before the workspace-trust prompt is even accepted. On Qwen Code, before the user has authenticated. On Grok Build, on the first keystroke. The trust dialog that is supposed to gate an untrusted repository runs after the code has already executed.

Which Agents Are Affected, and What Is Patched

Seven command-line agents are named, and the patch picture is uneven. Per The Hacker News and Manifold’s writeup, as of retesting on September 1:

• goose: fixed in 1.44.0. GitHub assigned CVE-2026-72718 a CVSS 4.0 base score of 7.0, credited to researcher Francisco Rosales, the only severity score any of these findings carries.
• Codex: OpenAI published three CVEs of its own the same day, covering the identical class, and the Codex CLI fix landed in 0.131.0. In the record for CVE-2026-19592, OpenAI wrote that the helper “runs outside Codex’s command sandbox and without a user-approval prompt,” letting attacker-controlled code run with the user’s privileges.
• Cursor: fixed. Manifold had documented the same class in Cursor CLI three weeks earlier, where a repository-supplied setup command ran before the trust prompt and outside the sandbox.
• Claude Code: the core.fsmonitor path was fixed by 2.1.196. But Manifold reports a second path, reached through a separate review command, that was still live when it retested on 2.1.252. The Hacker News confirmed Anthropic’s published npm advisory covers neither Claude Code finding.
• Hermes Agent, Qwen Code, and Grok Build: still executing repository-supplied commands when Manifold retested on September 1. Fixes pending.

Add the second Claude Code path to those three agents, and you get the four flaws that were unpatched at publication. Claude Code is Anthropic’s product, and we cover it here as straight vulnerability research: one of two reported paths is fixed, one is not, and that is the same standard we would apply to any vendor on the list.

The CVE trail needs a caveat. goose’s CVE-2026-72718 and OpenAI’s Codex CVEs are published. For Hermes Agent, Manifold says VulnCheck assigned CVE-2026-71963, but The Hacker News found no published record for that identifier in MITRE’s CVE List on September 2, so treat the Hermes CVE as reported-but-unconfirmed until it appears. No source reports any of these flaws being exploited in the wild, and none appear in the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog as of its September 1 version.

This is not entirely new ground, and the trust-dialog bypass is older than the current AI agents. Sonar reported the same sink in April, and Anthropic’s own June advisory for CVE-2026-55607 identifies Git fsmonitor execution during worktree operations. Sonar also traced the class back to Visual Studio Code before 1.63.1 (CVE-2021-43891) and JetBrains IDEs before 2021.3.1 (CVE-2022-24346), and a Cobalt red-team writeup in December put it plainly: FSMonitor abuse, in its words, “exploits a legitimate feature, not a bug.” A mitigation shipped for Claude Code once already, and Manifold reports the startup behavior present again in a later build. That regression is the uncomfortable part: the fix did not stick the first time.

Why the Repository Is the Attack Surface Now

Here is the catch that decides who is actually exposed. The .git config only travels when a repository arrives as files with its .git directory intact. A normal git clone from a hosting service does not copy the remote repo’s local config, so cloning from GitHub is mostly safe. What does preserve it: a shared archive (a zip someone sends you), a shared drive, a sync folder, or a USB stick. The repo has to reach you as a directory, not as a clone. Put the other way: if you only ever clone from a host over the network and never open code handed to you as a folder, this particular class does not reach you. The exposure is specifically about received directories that still carry their own config.

That narrows the blast radius, but it does not shrink it to nothing. Plenty of real workflows move code as folders. A contractor drops a project on a shared drive, a colleague sends a zip, a sample repo lands in a synced folder, a take-home coding exercise arrives as an archive. Any of those, opened with an agent, is enough. It also is not the first time an AI coding agent has been the delivery path rather than the target: in August, an agent told an engineer to install a malicious package and only a careful GitHub habit caught it, and a separate Claude Code Action flaw let a single GitHub issue hijack a repository before it was fixed.

My read: the mental model has to change, and this is assessment rather than a Manifold claim. Cloning or receiving a repository is now a code-execution event the moment an AI agent touches it. The repository is untrusted input, the same way an email attachment or a downloaded binary is, and it deserves the same suspicion. We spent years training developers that reading code is safe and running it is the risky step. Agentic tooling quietly erased that line, because the agent reads and runs in the same breath, and it does the running before it asks. That through-line sits under all eight flaws, and it will outlast this particular set of patches. For the broader defensive picture, our guide to securing AI systems and the tools built on them covers how to reason about agent trust boundaries.

What Developers Should Do

The defenses are unglamorous and they work. Treat a received repository as hostile until proven otherwise. Before you open a folder that arrived as files (not as your own clone) with any agent, inspect its .git config: the reported abuse turns on core.fsmonitor, and you can check for it with git config --get core.fsmonitor inside the directory, or audit your global configuration for the same key. Setting core.fsmonitor to false by default removes the most-reported sink.

Beyond the specific setting, run agents in an isolated or sandboxed workspace, a container or a throwaway VM, so a command that does fire cannot reach your real home directory, your SSH keys, or your cloud tokens. Keep the agents themselves current, because goose, Codex, Cursor, and one Claude Code path already have fixes and pinned-old installs stay exposed. Codex’s current release is 0.152.1, so anything below 0.131.0 is still vulnerable. And least-privilege the machine the agent runs on, since the flaw’s entire impact is that the command inherits whatever the logged-in user can reach.

If you maintain one of these agents, the vendor-side fix that Manifold and others point to is to strip the configuration on the background calls the agent makes, so a repository-supplied helper never runs during a routine status check.

Defender steps for the GitSpawn class of AI-coding-agent flaws. Source: Manifold Security and The Hacker News, September 2026.

What Is Still Open

Several threads are unresolved and worth watching. The second Claude Code path was live on 2.1.252 as of September 1, against a current release of 2.1.258, and no source states whether later builds closed it. Hermes Agent, Qwen Code, and Grok Build had no shipped fix at publication. The Hermes CVE is unconfirmed in MITRE. Separate research on the same Grok Build release earlier found it uploading whole Git repositories to xAI storage, which the company addressed on X rather than through an advisory, so these agents differ in how they handle disclosure as much as in whether they have shipped a fix. And Manifold says it detailed five of the eight findings and found the pattern in agents it did not name, so the seven-agent count reads as a floor rather than a ceiling. This is a developing story, and the patch table will move.

Primary Documents

• The Hacker News: Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code (September 2, 2026)
• Manifold Security: GitSpawn research writeup
• GitHub Security Advisory GHSA-r5pp-p5r8-466r (CVE-2026-72718, goose)