Malicious .git Configurations Turn AI Coding Agents into Executioners
Eight vulnerabilities in AI coding agents like Claude, Codex, and Cursor allow malicious Git configurations to execute attacker-controlled commands with user privileges.
Researchers at Manifold Security have uncovered a significant security risk affecting multiple popular AI coding agents, including Anthropic's Claude, OpenAI's Codex, and Cursor. The vulnerability, dubbed GitSpawn, leverages the .git/config file within a code repository to trick these agents into executing arbitrary commands with the user's privileges. This exploitation does not require a prompt or user approval and can occur outside the agent's intended sandbox environment.
The core of the vulnerability lies in Git's core.fsmonitor configuration setting. When a repository's .git/config file specifies a command for this setting, Git executes that command during routine operations like git status or git diff to identify file changes. AI coding agents, which often use these Git commands internally to understand the project's state, can be manipulated into running these attacker-supplied commands without explicit user consent or even a trust prompt, especially if the repository is shared via archives or sync folders rather than a standard clone.
Manifold Security identified eight distinct flaws across seven different AI coding agents. While fixes have been released for agents like Goose, Claude Code (partially), and Cursor, several others remained vulnerable at the time of disclosure. These include Hermes Agent, Qwen Code, and Grok Build, which were still executing repository-supplied commands when retested in early September. OpenAI also disclosed three CVEs related to this vulnerability class in Codex, acknowledging independent research from multiple groups.
OpenAI's advisory for CVE-2026-19592 highlights the severity, stating that the "helper runs outside Codex's command sandbox and without a user-approval prompt, allowing attacker-controlled code to run with the user's privileges." This means malicious code could potentially read, modify, or delete user files and access other resources available to the user's account. The exploitation vector relies on the .git directory being intact when the repository is transferred, a condition met by shared archives, sync folders, or USB drives, but not by typical Git clones.
The timing of the payload execution varies across affected agents. In some cases, like Claude Code and Hermes Agent, the malicious code executes before the user accepts a workspace trust prompt. For Qwen Code, execution can occur before user authentication, and in Grok Build, it can trigger on the very first keystroke. This pre-execution capability significantly lowers the barrier for exploitation.
While some vendors have been quick to patch, others are lagging. Goose has released version 1.44.0 to address the issue, and Codex CLI and Desktop versions have also received fixes. However, Anthropic's Claude Code has seen partial fixes, with a second path remaining vulnerable. Alibaba's Qwen Code and Nous Research's Hermes Agent are still awaiting patches. GitHub assigned CVE-2026-72718 a CVSS 4.0 score of 7.0 for the Goose agent, indicating a high severity.
This vulnerability class is not entirely new, with Sonar previously reporting similar trust-dialog bypasses in Visual Studio Code and JetBrains IDEs. Anthropic itself had previously mitigated related issues in Claude Code, but the GitSpawn vulnerability demonstrates a resurgence of this attack pattern, exploiting the fundamental plumbing beneath AI agents. The ongoing unpatched status of several agents underscores the persistent challenge of securing the complex software supply chain and the tools developers rely on daily.
The implications of GitSpawn are far-reaching for developers and organizations. The ability for malicious code to execute silently and with user privileges, bypassing security controls and user awareness, presents a substantial risk. As AI coding agents become more integrated into development workflows, securing these tools and their underlying dependencies against such subtle yet powerful attack vectors is paramount.
This new article expands on the GitSpawn vulnerability class, detailing how the core.fsmonitor feature in Git repositories can be weaponized. It specifically highlights that the attack vector requires the repository to be delivered as raw files, not via standard Git operations like clone or fetch, and lists affected AI coding agents including Claude Code, Goose, Hermes Agent, Qwen Code, and Grok Build, with some vendors having already patched while others remain unresponsive.