Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code

Manifold Security has identified eight security flaws across seven command-line AI coding agents, including Claude, Codex, and Hermes Agent, that could allow attackers to execute malicious code on a user's machine. The core issue lies in how these agents utilize Git's `core.fsmonitor` setting. This setting allows the agents to run commands from a repository’s `.git/config` file without requiring user interaction or a trust prompt, effectively bypassing the agent’s sandbox and granting attackers elevated privileges.

Specifically, the agents call Git commands in the background to determine their current branch and which files have changed, while simultaneously executing commands specified in the repository’s `.git/config`. This means that if a malicious repository is provided, attackers can inject commands that run without the user’s knowledge or consent.

Several fixes have been released for some agents, including Goose (version 1.44.0 and later), Claude Code (2.1.196), and Codex Desktop for macOS (26.519.22136). However, several agents remain vulnerable, including Codex CLI (0.102.0 through 0.130.0), Codex Desktop for Windows (26.304.38 through 26.513.40821), Qwen Code (0.19.6 and 0.22.3), and Hermes Agent (0.18.2 and 0.21.0). Grok Build (0.2.93 and 1.0.13) and Cursor CLI are also affected.

Anthropic disclosed pre-trust execution flaws in Claude Code, and a CVE (CVE-2026-55607) was assigned to them. xAI closed an earlier report of the same class as informative. Alibaba’s security response centre accepted the Qwen Code report on July 7.

Researchers have noted that this vulnerability isn’t a bug, but rather a consequence of Git’s flexibility and the automation of modern IDEs. It leverages the intersection of Git’s flexibility and the automation of modern IDEs to turn a repository open event into code execution. Cobalt described it as exploiting a legitimate feature.

Users are advised to perform the following checks: inspect `.git/config` before opening a received directory with an agent, looking for `core.fsmonitor`, `core.hooksPath`, and `attr.tree` alongside a clean or process filter; run `git config --get core.fsmonitor` inside any repository that arrived as files; run `git config --global --list | grep fsmonitor` to audit the global configuration; set `git config --global core.fsmonitor false` to disable the setting by default; and vendors strip the configuration on background calls, for example `git -c core.fsmonitor=false status`. No reports of exploitation have been found as of September 2nd, according to the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog.