Malicious Git Configurations Can Trigger Code Execution in AI Coding Agents
Summary
Manifold Security disclosed eight flaws across seven AI coding agents that let repository-controlled Git settings run commands on a developer’s machine. Four issues remained unpatched at publication; the article reports no known exploitation.
Key points
- A malicious repository’s .git/config can set core.fsmonitor to a command that runs when an agent invokes Git operations such as status or diff.
- The command runs with the user’s privileges outside the agent sandbox and without an approval prompt; exploitation requires receiving the repository with its .git directory intact.
- Manifold reported eight flaws across seven agents. Some execution paths trigger before workspace trust is accepted, user authentication, or—in Grok Build—the first keystroke.
- Fixes shipped for goose, Codex, and some Claude Code paths; Hermes Agent, Qwen Code, Grok Build, and a second Claude Code path remained affected at the reported retest.
- OpenAI assigned three CVEs to the same issue class in Codex. The article also identifies CVE-2026-72718 for goose and CVE-2026-71963 for Hermes Agent.
- The article reports no known exploitation and says the referenced CVEs were not listed in CISA’s Known Exploited Vulnerabilities catalog as of September 2.
- Users are advised to inspect .git/config in received repositories and audit or disable core.fsmonitor; agent vendors can strip the setting from background Git calls.
Article Details
- Vulnerability Types
- Command execution triggered by repository-controlled Git configuration, including core.fsmonitor
- Severity
- CVSS 4.0 base score 7.0 for CVE-2026-72718 in goose; no other scores reported.
- Affected Versions
- goose: all versions before 1.44.0
- Codex CLI: 0.102.0 through 0.130.0
- Codex Desktop for macOS: 260202.0859 through 26.513.31313
- Codex Desktop for Windows: 26.304.38 through 26.513.40821
- Codex Desktop for Windows (Microsoft Store package): 26.304.38.0 through 26.513.4821.0
- Claude Code: 2.1.193 (core.fsmonitor path confirmed); 2.1.252 (claude ultrareview path confirmed)
- Hermes Agent: 0.18.2 and 0.21.0
- Qwen Code: 0.19.6 and 0.22.3
- Grok Build: 0.2.93 and 1.0.13
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- partial
- Workarounds
- Inspect .git/config for core.fsmonitor, core.hooksPath, attr.tree, and clean or process filters before opening a received directory with an agent.
- Run git config --get core.fsmonitor inside repositories received as files.
- Disable the setting globally with git config --global core.fsmonitor false.
- For background Git calls, vendors can disable the setting with a command such as git -c core.fsmonitor=false status.
MITRE ATT&CK
CVE
CVE-2026-19592The code can read, change, or delete the user’s files and access other resources available to the user’s account,” OpenAI said in the record for CVE-2026-19592.CVE-2026-55607Anthropic has previously disclosed pre-trust execution flaws in Claude Code, and its June advisory for CVE-2026-55607 identifies git fsmonitor execution during worktree operations.CVE-2026-71963VulnCheck assigned CVE-2026-71963, according to Manifold.CVE-2026-72718GitHub assigned CVE-2026-72718 a CVSS 4.0 base score of 7.0 in an advisory crediting Francisco Rosales, the only score any of these findings carries.
People
Vendors
Alibaba GroupAlibaba’s security response centre accepted the Qwen Code report on July 7.AnthropicSonar reported the same sink in April, noted that Anthropic had already moved the startup sequence once to close it, and identified the same trust-dialog bypass in Visual Studio Code before 1.63.1 (CVE-2021-43891) andCursorGoose, Claude Code, and Cursor received fixes for some paths.Nous ResearchNous Research’s Hermes Agent, which an operator ran unattended in an intrusion against a Thai government network in July, drew six contact attempts across five channels and left the private advisory untriaged, ManifoldOpenAIOpenAI also issued three CVEs for the same attack class in Codex, while affected tools and versions included goose, Claude Code, Codex, Hermes Agent, Qwen Code, and Grok Build.xAIxAI closed an earlier report of the same class as informative on July 1.
Products
Claude CodeOpenAI also issued three CVEs for the same attack class in Codex, while affected tools and versions included goose, Claude Code, Codex, Hermes Agent, Qwen Code, and Grok Build.Codex CLICodex CLI – 0.102.0 through 0.130.0, fixed in 0.131.0Codex DesktopCodex Desktop for macOS – 260202.0859 through 26.513.31313, fixed in 26.519.22136Cursor CLIManifold documented the same class in Cursor CLI three weeks earlier, where a repository-supplied setup command ran before the workspace-trust prompt and outside the sandbox.GitSecurity disclosed eight flaws across seven command-line AI coding agents where repository-controlled Git settings could trigger code execution on a developer’s machine, with four issues still unpatched atgooseOpenAI also issued three CVEs for the same attack class in Codex, while affected tools and versions included goose, Claude Code, Codex, Hermes Agent, Qwen Code, and Grok Build.Grok BuildOpenAI also issued three CVEs for the same attack class in Codex, while affected tools and versions included goose, Claude Code, Codex, Hermes Agent, Qwen Code, and Grok Build.Hermes AgentOpenAI also issued three CVEs for the same attack class in Codex, while affected tools and versions included goose, Claude Code, Codex, Hermes Agent, Qwen Code, and Grok Build.Qwen CodeOpenAI also issued three CVEs for the same attack class in Codex, while affected tools and versions included goose, Claude Code, Codex, Hermes Agent, Qwen Code, and Grok Build.