Git configuration flaw lets AI coding agents run repository commands
Manifold Security has disclosed eight security flaws affecting seven command-line AI coding agents, including Claude Code, Codex, Cursor, goose, Hermes Agent, Qwen Code and Grok Build. A malicious repository can use its own .git/config file to name a command that an agent subsequently executes on the developer’s machine.
The command runs with the user’s privileges, outside the agent sandbox and without an approval prompt. Manifold said the attack requires a repository to be delivered as files with its .git directory intact, such as through a shared archive, drive, sync folder or USB device. A conventional Git clone does not preserve that condition.
Git’s fsmonitor setting becomes an execution path
The central mechanism is core.fsmonitor, a Git performance setting whose value is a command Git uses to identify changed files. Git reads that value from the repository-local .git/config. Operations that refresh the index, including git status and git diff, can execute the configured command.
AI coding agents commonly call those Git commands in the background to identify the current branch and changed files. If the agent leaves repository configuration in place, the background call can execute the attacker-controlled value. Manifold described the weakness as a problem in the ordinary subprocesses launched during agent startup rather than in an AI model itself.
OpenAI published three CVEs on the same day for the same vulnerability class in Codex. In the record for CVE-2026-19592, OpenAI said the helper runs outside Codex’s command sandbox and without user approval, allowing code to read, modify or delete files and access other resources available to the user account.
Fix status differs across products
Fixes are available for goose 1.44.0, Codex CLI 0.131.0, Codex Desktop releases 26.519.22136 for macOS and 26.519.21041 for Windows, and the core.fsmonitor path in Claude Code 2.1.196. Manifold also reported a separate Claude Code path through claude ultrareview as live in 2.1.252 during testing on September 1.
Hermes Agent versions 0.18.2 and 0.21.0, Qwen Code versions 0.19.6 and 0.22.3, and Grok Build versions 0.2.93 and 1.0.13 were still confirmed as affected by Manifold, with fixes pending at publication. The researchers also documented a related issue in Cursor CLI, where a repository-supplied setup command ran before the workspace-trust prompt and outside the sandbox.
On Claude Code and Hermes Agent, Manifold found execution before a workspace-trust decision. On Qwen Code it occurred before authentication, while Grok Build could trigger the command on the first keystroke. No source reported exploitation, and none of the listed CVEs appeared in CISA’s Known Exploited Vulnerabilities catalog as checked on September 2.
What teams should change
Teams receiving project directories should inspect .git/config before opening them in an AI agent, particularly for core.fsmonitor, core.hooksPath, and attr.tree combined with clean or process filters. Administrators can check a repository with git config --get core.fsmonitor, audit global settings with git config --global --list | grep fsmonitor, and disable the default with git config --global core.fsmonitor false.
For vendors, the practical mitigation is to neutralise repository-supplied configuration on background Git calls, for example by invoking git -c core.fsmonitor=false status. For businesses, updating agents is necessary but not sufficient: received working directories and their preserved Git metadata need to be handled as untrusted code-bearing material.