Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code

What it is

Eight flaws across seven CLI AI coding agents where a repository's own .git/config names a command the agent executes on the developer's machine — outside the agent sandbox, without an approval prompt, as the user. Manifold Security (as GitSpawn) disclosed them; four remained unpatched at publication. Named CVEs: CVE-2026-72718 (goose, CVSS 4.0 base 7.0, the only scored finding, credited to Francisco Rosales), CVE-2026-19592 (Codex, one of three OpenAI published the same day), CVE-2026-71963 (Hermes Agent, VulnCheck-assigned per Manifold but with no MITRE record as of Sept 2), and the earlier CVE-2026-55607 (Anthropic's June advisory naming fsmonitor execution during worktree operations).

How it works

core.fsmonitor is a Git performance setting whose value is a command Git runs to identify changed files, read from the repository's own .git/config. Any index-refreshing operation — git status, git diff — executes it. Agents run these in the background at startup to determine branch and changed files, leaving the malicious config untouched. On Claude Code and Hermes the payload fires before the trust prompt; on Qwen Code before authentication; on Grok Build on the first keystroke. goose's goose review builds invocations with only -c core.quotePath=off and strips nothing else.

Preconditions / Affected

Exploitation requires the repo to arrive as files with .git intact — a shared archive, shared drive, sync folder, or USB stick preserves this; an ordinary clone does not. Version boundaries:

• goose — < 1.44.0, fixed 1.44.0
• Codex CLI — 0.102.0–0.130.0, fixed 0.131.0 (current 0.152.1; pins below 0.131.0 remain exposed)
• Codex Desktop macOS — 260202.0859–26.513.31313, fixed 26.519.22136
• Codex Desktop Windows — 26.304.38–26.513.40821, fixed 26.519.21041 (Store: fixed 26.519.2081.0)
• Claude Code — fsmonitor path confirmed on 2.1.193, fixed 2.1.196; a second claude ultrareview path (different, withheld config key) confirmed live on 2.1.252 against release 2.1.258
• Hermes Agent — 0.18.2, 0.21.0 confirmed, fix pending
• Qwen Code — 0.19.6, 0.22.3 confirmed, fix pending (0.22.3 still latest published)
• Grok Build — 0.2.93, 1.0.13 confirmed, fix pending

Note: Claude 2.0.34 (Nov 5, 2025) had already moved startup to stop git status before trust, but Manifold found the same behavior back in 2.1.193 (June 25, 2026).

What to do

Inspect a received directory before opening it with an agent, and disable the setting globally:

git config --get core.fsmonitor
git config --global --list | grep fsmonitor
git config --global core.fsmonitor false

Also check .git/config for core.fsmonitor, core.hooksPath, and attr.tree alongside a clean/process filter. Vendors are advised to strip the config on background calls, e.g. git -c core.fsmonitor=false status.

Caveats

No source reports exploitation of any finding; none appear in CISA's KEV catalog (version 2026.09.01, 1,687 entries) as of Sept 2. Several reports were closed as duplicates or triaged poorly: Anthropic published no advisory covering either Claude Code finding; xAI closed reports as informative/duplicate and addressed a separate Grok Build repo-upload issue on X; Hermes' advisory went untriaged despite the agent being run in a July intrusion against a Thai government network. Whether releases after 2.1.252 close the ultrareview path is unstated.