Security researchers at Manifold Security have uncovered a novel attack method affecting several AI coding agents—including Claude Code, Codex, Cursor, Qwen Code, Grok Build, Hermes Agent, and goose—that allows malicious Git configuration files to execute attacker-controlled commands on users’ machines. In many cases, this can occur before the user grants permission or approves any prompts, and the execution happens outside the modeled sandbox. The vulnerability stems from how these tools handle settings loaded from the .git/config file in repositories. Such configurations aren’t generated during a normal git clone, but persist when a repo is shared as files via archives, shared drives, sync folders, or USB sticks. The underlying issue involves Git’s core.fsmonitor feature, which specifies a command that Git executes to detect file changes. This setting is read directly from the repo’s own configuration, meaning that commands defined there can run during simple operations like git status or diff.
Which Agents Are Vulnerable, What Has Been Patched
Among the affected tools, some have already issued fixes. The goose agent is vulnerable in versions earlier than 1.44.0, but the issue is resolved in 1.44.0. Codex CLI versions 0.102.0 through 0.130.0, and certain Codex Desktop builds for macOS, Windows, and Microsoft Store versions are also impacted, all patched with newer releases. Claude Code has one core.fsmonitor-related path fixed in version 2.1.196, yet another entry point via its ultrareview component remains active in version 2.1.252 (current release as of September 1, 2026). Versions of Hermes Agent (0.18.2, 0.21.0), Qwen Code (0.19.6, 0.22.3), and Grok Build (0.2.93, 1.0.13) were confirmed vulnerable and have not yet received fixes.
How Attackers Can Exploit the Weakness
The danger arises because these agents run commands like core.fsmonitor before any trust or authentication steps are completed. In Claude Code and Hermes Agent, the payload can run even before the user accepts a workspace-trust prompt. In Qwen Code, the issue circumvents user authentication, and Grok Build is triggered as soon as the first keystroke occurs. The attackers can leverage features like core.fsmonitor, core.hooksPath, or certain attributes to inject a command via .git/config and have that command run without any sign or prompt.
Manifold also found this class of vulnerability in Cursor CLI, which runs repo-supplied setup commands before any trust checks. OpenAI published CVE-2026-19592 for Codex, describing attacker code running outside Codex’s command sandbox without any user prompt, which could lead to arbitrary file read, modification, or deletion.
Recommendations and What Still Needs Fixing
Users are advised to manually inspect repository configurations before opening directories with AI agents. Checking for dangerous keys like core.fsmonitor, core.hooksPath, or tree attribute filters in .git/config is essential. Commands like git config --get core.fsmonitor can confirm whether a setting is present, and disabling it globally via git config --global core.fsmonitor false can offer extra protection. Some vendors are stripping unsafe Git configuration values in background calls to avoid risks.
As of September 2, 2026, some issues remain unpatched. Claude Code’s ultrareview path continues to accept malicious configs in version 2.1.252. Hermes Agent, Qwen Code, and Grok Build all still harbor unmitigated vulnerabilities in versions previously identified as problematic.
The full implications of these vulnerabilities are unclear; while many CVEs have been issued, none of the flaws had been observed in active exploitation as of early September 2026. Even so, the nature of the attack—leveraging a legitimate Git feature rather than a coding bug—means the risk is deep-seated.
This discovery highlights an often-overlooked attack surface in modern AI development workflows: the plumbing beneath agents and IDEs. The way AI coding tools automatically invoke Git operations can be abused when trust, authentication, or workspace prompts don’t gate execution. As users deploy agents more broadly, this flaw intensifies. Going forward, we’ll be watching how remaining agents handle fixes, the degree of vendor transparency, and whether these vulnerabilities become leveraged in real-world supply-chain or ransomware cases.
