Emerging ThreatsMalware & Ransomware

AI Coding Agents Exposed to Code Execution via Malicious Git Configs

Analyst 207||Source: TheHackerNews
Developer workstation with laptop, terminal, and papers, showing a Git config file on screen in a bright office setting.

Manifold Security has disclosed eight security flaws across seven command-line AI coding agents in which a repository's own Git configuration can cause the agent to run attacker-supplied commands on a developer's machine, four of them still unpatched at publication.

How core.fsmonitor turns a repo into code execution

The injected execution leverages Git's core.fsmonitor setting, a performance option whose value is a command that Git runs to identify changed files. Git reads core.fsmonitor from the repository's own .git/config, and any operation that refreshes the index — including git status and git diff — executes that command. Manifold Security wrote that "The vulnerability is not in the model, or in anything new. It is in the ordinary plumbing underneath, the subprocess an agent spawns at session startup to work out where it is."

Agents call these Git commands in the background to determine branch and changed files; the calls run outside the agent's sandbox, execute as the user, and do so without an approval prompt, according to Manifold. Exploitation requires the repository to arrive as files with its .git directory intact — for example via a shared archive, a shared drive, a sync folder, or a USB stick — because an ordinary git clone does not preserve that directory.

Affected agents and exact versions

  • goose — All versions prior to 1.44.0; fixed in 1.44.0
  • Codex CLI — 0.102.0 through 0.130.0; fixed in 0.131.0
  • Codex Desktop for macOS — 260202.0859 through 26.513.31313; fixed in 26.519.22136
  • Codex Desktop for Windows — 26.304.38 through 26.513.40821; fixed in 26.519.21041, and Microsoft Store package 26.304.38.0 through 26.513.4821.0, fixed in 26.519.2081.0
  • Claude Code — Confirmed by Manifold on 2.1.193 and fixed by 2.1.196 on the core.fsmonitor path, with the claude ultrareview path confirmed live on 2.1.252
  • Hermes Agent — 0.18.2 and 0.21.0 confirmed by Manifold; fix pending
  • Qwen Code — 0.19.6 and 0.22.3 confirmed by Manifold; fix pending
  • Grok Build — 0.2.93 and 1.0.13 confirmed by Manifold; fix pending

What vendors have done — and what remains live

Manifold reported fixes shipped for goose, Claude Code (the core.fsmonitor path), and Cursor. On retest September 1, Manifold found Hermes Agent, Qwen Code, Grok Build, and a second path in Claude Code still executing repository-supplied commands.

OpenAI published three CVEs the same day as Manifold covering the identical class in Codex; OpenAI's record for CVE-2026-19592 states: "The helper runs outside Codex's command sandbox and without a user-approval prompt, allowing attacker-controlled code to run with the user's privileges. The code can read, change, or delete the user's files and access other resources available to the user's account."

GitHub assigned CVE-2026-72718 (the goose finding) a CVSS 4.0 base score of 7.0 in an advisory crediting Francisco Rosales. Sonar and other researchers previously reported the same sink in different tools and noted that similar pre-trust execution issues had been addressed in prior product updates; Sonar observed that Anthropic had moved Claude Code's startup sequence once to close a variant and that a mitigation shipped in Claude 2.0.34 on November 5, 2025, but Manifold found startup behavior present again in Claude 2.1.193 (shipped June 25, 2026).

Operational context, evidence of exploitation, and related findings

No source reports confirmed exploitation of these findings. The Hacker News checked the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog on September 2 (version 2026.09.01) and found none of the CVEs listed.

Manifold documented related instances elsewhere: Cursor CLI three weeks earlier had a repository-supplied setup command that ran before the workspace-trust prompt and outside the sandbox. Separate research on Grok Build's 0.2.93 build found the tool uploading whole Git repositories to xAI storage, an issue xAI addressed on X rather than through an advisory. Manifold also reported that Nous Research's Hermes Agent was run unattended in an intrusion against a Thai government network in July; the Hermes private advisory drew six contact attempts across five channels and remained untriaged, Manifold said.

VulnCheck assigned CVE-2026-71963 to Hermes according to Manifold, but The Hacker News found no published record for that identifier in MITRE's CVE List on September 2, where adjacent identifiers are published VulnCheck records. Manifold said five of its eight reports duplicated findings other researchers had filed independently.

As an interpretive summary from a red-team writeup: "FSMonitor abuse exploits a legitimate feature, not a bug. It leverages the intersection of Git's flexibility and the automation of modern IDEs to turn a repository open event into code execution," Cobalt wrote in December.

Checks and mitigations for users, and release notes to watch

  • Inspect .git/config before opening a received directory with an agent; look for core.fsmonitor, core.hooksPath, and attr.tree alongside a clean or process filter.
  • Run git config --get core.fsmonitor inside any repository that arrived as files.
  • Audit global settings with git config --global --list | grep fsmonitor and disable by default with git config --global core.fsmonitor false.
  • Vendors can and do strip the configuration on background calls, for example by running git -c core.fsmonitor=false status; several vendors have adopted this pattern in fixes.

Note the current status of tool releases: Codex CLI's current release is 0.152.1 as of September 2, so installations pinned below 0.131.0 remain exposed unless upgraded.

These disclosures highlight a recurring operational point: simple repository metadata can carry powerful side effects when tools automate Git operations before any human trust decision or authentication. Whether vendors will converge on consistent startup hardening and transparent advisories remains the immediate question for teams that open unvetted repositories.

Original story

Code ExecutionEmerging ThreatsSupply ChainSoftware Development SecurityAI Coding AgentsMalicious Git ConfigsCommand-Line SecurityGit Vulnerability
Related Intelligence

Continue Reading

Smartphone on cluttered coffee shop table with blank, out-of-focus screen.

Meta Ads Spread StreamRat Trojan with Near-Total Android Device Control

Meet StreamRat, a sneaky new Android banking trojan that's giving hackers near-total control over infected devices - and it's been spreading through paid social media ads on Meta. This sophisticated threat is a major red flag for Android users, especially in Spain where the campaign was focused.

Analyst 207
Network operations center with servers and equipment, focusing on a router on a rack.

BGP Hijack Targets Virtualizor Users with Persistent Root Access Malware

A recent BGP hijack attack targeted users of Virtualizor with malware that granted persistent root access, affecting a limited number of servers that received rerouted Softaculous update traffic during a 33-hour window. The attackers cleverly obtained a valid Let's Encrypt certificate, making the malicious server appear trustworthy to clients.

Analyst 207
Brazilian government building with people walking by, subtle server room in background.

Malicious Apache Modules Redirect Brazilian Government Traffic to Betting Sites

Brazilian government websites have been hijacked by malicious actors, redirecting traffic to betting sites in a sneaky campaign attributed to a Chinese-speaking cluster known as Gambling Goblin or Earth Berberoka. This multilingual scheme has been cleverly manipulating search engines and government systems since mid-2025.

Analyst 207
Server room with rows of computer servers and networking equipment, featuring a single Apache web server in the foreground.

Malicious Apache Modules Empower Gambling Goblin's SEO Fraud Campaign

Meet Gambling Goblin, a Chinese-speaking cybercrime cluster that's been secretly hijacking Brazilian government and education websites to fuel a massive SEO fraud campaign since mid-2025. They're using sneaky Apache modules to disguise their malicious activity and stay under the radar.

Analyst 207