{"id":23743,"date":"2026-09-02T14:06:00","date_gmt":"2026-09-02T14:06:00","guid":{"rendered":"https:\/\/scannn.com\/malicious-git-configs-can-make-claude-codex-cursor-and-other-ai-agents-run-attacker-code\/"},"modified":"2026-09-02T14:06:00","modified_gmt":"2026-09-02T14:06:00","slug":"malicious-git-configs-can-make-claude-codex-cursor-and-other-ai-agents-run-attacker-code","status":"publish","type":"post","link":"https:\/\/scannn.com\/lv\/malicious-git-configs-can-make-claude-codex-cursor-and-other-ai-agents-run-attacker-code\/","title":{"rendered":"Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code"},"content":{"rendered":"\n
\n
<\/a><\/div>\n

Manifold Security has disclosed eight security flaws across seven command-line AI coding agents in which a repository’s own Git configuration names a command that the agent runs on the developer’s machine, four of them still unpatched at publication.<\/p>\n

The command executes as the user, outside the agent’s sandbox and without an approval prompt, and exploitation requires the repository to arrive as files with its\u00a0.git\u00a0directory intact, which a shared archive, a shared drive, a sync folder, or a USB stick preserves, whereas an ordinary clone does not.<\/p>\n

Fixes have shipped for goose, Claude Code, and Cursor, while Hermes Agent, Qwen Code, Grok Build, and a second path in Claude Code were still executing repository-supplied commands when Manifold retested them on September 1.<\/p>\n

OpenAI published three CVEs of its own the same day covering the identical class in Codex, credited to three unrelated research groups.<\/p>\n

“The helper runs outside Codex’s command sandbox and without a user-approval prompt, allowing attacker-controlled code to run with the user’s privileges. The code can read, change, or delete the user’s files and access other resources available to the user’s account,” OpenAI said in the record for CVE-2026-19592<\/strong>.<\/p>\n

On Claude Code and Hermes Agent, the payload fires before the workspace-trust prompt is accepted; on Qwen Code, before the user has authenticated; and on Grok Build, on the first keystroke.<\/p>\n

core.fsmonitor<\/strong>\u00a0is a Git performance setting whose value is a command that Git runs to identify changed files, and Git reads it from the repository’s own\u00a0.git\/config. Any operation that refreshes the index, including\u00a0git status\u00a0and\u00a0git diff, executes that command.<\/p>\n

<\/p>\n

The agents call those commands in the background to determine which branch they are on and which files have changed, leaving the repository’s configuration untouched.<\/p>\n

Manifold, which\u00a0published the findings as GitSpawn<\/a><\/strong>, wrote up five of the eight in detail and said it found the pattern in more agents than it names.<\/p>\n

<\/p>\n

“The vulnerability is not in the model, or in anything new. It is in the ordinary plumbing underneath, the subprocess an agent spawns at session startup to work out where it is,” Manifold said.<\/p>\n

The following agents and versions are affected –<\/p>\n