Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code
Manifold Security disclosed eight vulnerabilities across seven AI coding agents (Claude Code, Codex, Cursor, goose, Hermes Agent, Qwen Code, Grok Build) where malicious .git configurations can execute attacker-controlled commands on a developer's machine The attack exploits Git's `core.fsmonitor` setting, which runs a user-specified command to detect file changes; AI agents invoke Git operations in the background without sanitizing repository-supplied configs Exploitation requires the repository
Analysis
TL;DR
- Manifold Security disclosed eight vulnerabilities across seven AI coding agents (Claude Code, Codex, Cursor, goose, Hermes Agent, Qwen Code, Grok Build) where malicious .git configurations can execute attacker-controlled commands on a developer's machine
- The attack exploits Git's
core.fsmonitorsetting, which runs a user-specified command to detect file changes; AI agents invoke Git operations in the background without sanitizing repository-supplied configs - Exploitation requires the repository to arrive with its
.gitdirectory intact (via archive, USB, shared drive), bypassing normal git clone protections, and executes before trust prompts, authentication, or model calls - Four of seven agents remained unpatched at publication (Hermes Agent, Qwen Code, Grok Build, and a second Claude Code path via
claude ultrareview), with some vendors ignoring or closing reports as duplicates - The vulnerability is rated CVSS 7.0 and represents a systemic class issue affecting the "ordinary plumbing" of AI agent startup sequences, with prior analogous flaws in VS Code and JetBrains IDEs
Why It Matters
This vulnerability exposes a critical trust boundary failure in AI coding agents: malicious code can execute with full user privileges before any security prompt, authentication, or model interaction occurs, making it a pre-authentication, pre-trust attack vector. For AI practitioners and security teams, it underscores that agent security depends not just on model-level safeguards but on the entire subprocess and configuration pipeline, and that supply-chain-style attacks via seemingly benign repositories are a realistic threat.
Technical Details
- Attack vector: Git's
core.fsmonitorconfiguration key allows a repository to specify a command that Git executes to identify changed files; AI agents call Git operations (e.g.,git status,git diff) during session startup to determine branches and modified files, inadvertently executing attacker-controlled commands from.git/config - Execution context: The malicious command runs as the legitimate user, outside the agent's sandbox, without any approval prompt, workspace-trust dialog, or model call—on some agents it fires before authentication (Qwen Code) or even the first keystroke (Grok Build)
- Delivery mechanism: Exploitation requires the repository to be delivered with its
.gitdirectory preserved (shared archive, USB stick, sync folder, or network drive), since a standardgit clonestrips the.gitdirectory and prevents the attack - Affected agents and patch status: goose (fixed in 1.44.0), Codex CLI/Desktop (fixed in 0.131.0 / 26.519.x), Claude Code (partially fixed—
core.fsmonitorpath patched in 2.1.196 butclaude ultrareviewpath still live on 2.1.258); Hermes Agent, Qwen Code, and Grok Build remain unpatched as of September 2026 - Historical context: Sonar identified the same vulnerability class in April; Anthropic previously mitigated a related issue in Claude Code v2.0.34 (November 2025) only for the regression to reappear in v2.1.193 (June 2026); analogous trust-dialog bypasses were found in VS Code before 1.63.1 and JetBrains IDEs before 2021.3.1
Industry Insight
- AI agent vendors must treat repository-supplied configuration as untrusted input and implement strict allowlisting or sanitization of all Git configuration keys during agent startup, rather than relying on sandboxing or post-hoc approval prompts that can be bypassed
- The repeated recurrence of this vulnerability class across multiple vendors and over time suggests a systemic gap in secure-by-design principles for AI coding tools; industry-wide standards or shared security baselines for agent startup sequences could prevent regression
- Security teams and developers should audit their AI agent environments for exposure to untrusted repositories, treat shared drives and archived code as potential attack vectors, and prioritize patching for agents still running unpatched versions—especially Hermes Agent, Qwen Code, and Grok Build, where vendor responsiveness has been poor or absent
Disclaimer: The above content is generated by AI and is for reference only.