Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code

Summary: Manifold Security disclosed eight flaws across seven command-line AI coding agents in which a repository's own Git configuration names a command the agent runs on the developer's machine, with four still unpatched when retested on September 1. The mechanism is core.fsmonitor, a Git performance setting whose value is a command Git executes on any index refresh such as git status or git diff, which the agents call in the background at startup. Fixes shipped for goose, Claude Code, and Cursor, while Hermes Agent, Qwen Code, Grok Build, and a second Claude Code path still executed repository-supplied commands; OpenAI published three CVEs for the same class in Codex the same day.
Why it matters: The payload fires before the workspace-trust prompt on Claude Code and Hermes Agent, before authentication on Qwen Code, and on the first keystroke on Grok Build, so the approval step security teams rely on never gets a chance to run. None of the CVEs appear in CISA's KEV catalog (version 2026.09.01, 1,687 entries), and Codex installations pinned below 0.131.0 remain exposed.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2021-43891 CVE-2022-24346 CVE-2026-19592 CVE-2026-55607 CVE-2026-72718
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026