A malicious git config can make AI coding agents like Claude Code, Codex, and Cursor run attacker-supplied commands on the developer's machine, outside the agent's sandbox and with no approval prompt. Manifold Security disclosed eight flaws across seven command-line AI coding agents where a repository's own Git configuration names a command the agent then runs as the user. Exploitation only needs the repository to arrive as files with its .git directory intact, which a shared archive, sync folder, shared drive, or USB stick preserves, whereas an ordinary git clone does not. Four of the flaws were still unpatched at publication.

The mechanism abuses core.fsmonitor, a legitimate Git performance setting whose value is a command that Git runs to identify changed files, read straight from the repository's own .git/config. Any operation that refreshes the index, including git status and git diff, executes that command, and because the agents run those commands in the background, the attacker's code fires without the developer doing anything obviously risky. On Claude Code and Hermes Agent the payload runs before the workspace-trust prompt is accepted, on Qwen Code before the user authenticates, and on Grok Build on the first keystroke. OpenAI published three CVEs of its own the same day for the identical class in Codex, including CVE-2026-19592, noting the code runs with the user's privileges and can read, change, or delete files.

Which AI coding agents are patched, and which are not?

Fixes shipped for goose, Claude Code, and Cursor, but Manifold reported that Hermes Agent, Qwen Code, Grok Build, and a second path in Claude Code were still executing repository-supplied commands when it retested on September 1. Because the trigger is a data file inside a shared repository rather than a network service, the fix is both a code patch in the agent and a habit change in how developers receive untrusted repositories.

Why does an ordinary clone not trigger it?

Because a normal git clone does not copy a remote repository's local config into your .git/config, so the malicious core.fsmonitor value never lands on your machine. The danger appears when a repository is moved as raw files with its .git directory preserved, which is exactly what happens with a zipped project, a synced folder, or a repo handed over on a drive. That distinction is the whole attack: the same project is safe cloned and dangerous copied, and most developers have no reason to expect the difference.

Our read

This is the vibe-coding threat model made concrete: the AI agent does not need a network exploit, it just needs to read a poisoned data file the developer trusted. It generalizes the lesson that an agent treats the content it consumes as authoritative, so a repository is untrusted input, not just code to open. The verifiable-by-design response is to treat any externally sourced repo as hostile until proven otherwise, patch the agents that have fixes, and for the ones that do not, avoid opening file-copied repositories with .git intact. Nexus Void tests exactly this class of agent-trust boundary in scoped VAPT engagements; if your team builds with these tools, that boundary is worth verifying.

Reporting by The Hacker News; flaw class and CVE detail per Manifold Security and OpenAI's advisories. Sources linked above.

Related: AI coding assistant security risks and What is MCP security?.