Malicious Git Configs Let AI Coding Agents Execute Attacker Commands
Security researchers have disclosed multiple security flaws in popular command line AI coding agents that can allow malicious Git repositories to execute attacker controlled commands on a developer's machine.
The vulnerabilities affect seven AI coding agents and involve Git configuration files supplied by repositories. Four of the reported issues remained unpatched when researchers retested the affected software on September 1, 2026.
The attacks can execute commands with the user's privileges, outside the AI agent's sandbox and without showing an approval prompt.
How the Attack Works
The vulnerabilities abuse a legitimate Git feature called core.fsmonitor.
Git uses core.fsmonitor to identify changed files and improve repository performance. The setting can contain a command that Git executes when refreshing the repository index.
Importantly, Git can read this configuration directly from the repository's .git/config file.
When AI coding agents automatically run Git commands such as git status or git diff, the malicious command stored in the repository configuration can be executed in the background.
This means simply opening or working with a malicious repository can potentially trigger code execution.
The attack requires the repository to arrive as files while retaining its .git directory. This can happen through shared archives, shared drives, synchronization folders, or USB devices. A normal Git clone does not preserve an attacker's repository configuration in the same way.
AI Agents Affected
Manifold Security reported the issue across several AI coding agents.
Affected products and reported versions include:
- goose: Versions before 1.44.0. Fixed in 1.44.0.
- Codex CLI: Versions 0.102.0 through 0.130.0. Fixed in 0.131.0.
- Codex Desktop for macOS: Versions 260202.0859 through 26.513.31313. Fixed in 26.519.22136.
- Codex Desktop for Windows: Versions 26.304.38 through 26.513.40821. Fixed in 26.519.21041.
- Claude Code: The
core.fsmonitorpath was fixed in version 2.1.196, but another related execution path remained active during testing. - Hermes Agent: Versions 0.18.2 and 0.21.0 were confirmed vulnerable, with a fix pending.
- Qwen Code: Versions 0.19.6 and 0.22.3 were confirmed vulnerable, with a fix pending.
- Grok Build: Versions 0.2.93 and 1.0.13 were confirmed vulnerable, with a fix pending.
Commands Can Run Before Security Checks
One of the most concerning aspects is when the malicious command executes.
Researchers found that:
- Claude Code and Hermes Agent could execute the payload before the workspace trust prompt was accepted.
- Qwen Code could execute it before the user authenticated.
- Grok Build could trigger execution on the first keystroke.
This can effectively bypass security controls that users expect to protect them before an AI coding agent begins interacting with a repository.
Codex Also Affected
OpenAI separately published three CVEs covering the same class of issue in Codex.
According to OpenAI, the vulnerable helper could execute outside the Codex command sandbox and without a user approval prompt.
A successful attack could allow malicious code to run with the user's privileges and potentially read, modify, or delete files accessible to that account.
The reported Codex vulnerabilities include:
- CVE-2026-19592
- Additional CVEs covering Codex CLI and desktop versions
The affected Codex versions were later fixed, and the current Codex CLI release was reported as 0.152.1 as of September 2, 2026.
Claude Code Has a History of Similar Issues
The Git configuration problem is not entirely new.
Researchers previously identified issues involving Claude Code executing Git commands before users approved repository trust.
A previous version of Claude Code changed its startup sequence to avoid running git status before the trust dialog. However, researchers later found similar behavior again in version 2.1.193.
Manifold reported that the core.fsmonitor issue was fixed in version 2.1.196. However, a separate path involving the claude ultrareview functionality was still found to execute repository supplied commands during testing.
Other AI Agent Issues Remain Open
Manifold reported that several vendors had not yet fully addressed the problem when researchers retested their software.
The Qwen Code report was accepted by Alibaba's security response center, but version 0.22.3 remained the latest published release at the time of the researchers' September 2 check.
For Hermes Agent, researchers said multiple attempts to contact the project about the vulnerability received no effective response.
xAI had previously closed an earlier report involving the same class of vulnerability as informative. A later Manifold report was closed as a duplicate.
Researchers also identified a similar issue in Cursor CLI, where a repository supplied setup command could run before the workspace trust prompt and outside the sandbox.
Why Git Configuration Is a Security Risk
The problem comes from the combination of two legitimate technologies.
Git repositories can contain configuration that controls how Git behaves, while AI coding agents automatically execute Git commands in the background to understand the repository.
When these behaviors are combined, a malicious repository can potentially turn an ordinary repository opening event into arbitrary command execution.
The risk becomes greater when AI agents perform automated operations before asking users for trust or permission.
No Known Exploitation Reported
There were no reported cases of these vulnerabilities being exploited in the wild at the time of disclosure.
The reported CVEs were also not listed in the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog during the researchers' September 2 check.
However, successful exploitation could provide attackers with the same permissions available to the affected developer account.
How Users Can Protect Themselves
Users working with AI coding agents should be careful when opening repositories received through untrusted channels.
Recommended checks include:
- Inspect
.git/configbefore opening an untrusted repository with an AI coding agent. - Look for suspicious settings such as
core.fsmonitorand other Git configuration entries that can invoke commands. - Run
git config --get core.fsmonitorinside repositories received as files. - Review the global Git configuration with
git config --global --list | grep fsmonitor. - Consider disabling Git FSMonitor globally with
git config --global core.fsmonitor falsewhen it is not required. - Keep AI coding agents updated to versions containing the relevant security fixes.
- Avoid opening untrusted repositories directly in AI coding environments.
Developers and organizations should also treat repositories received as ZIP files, shared folders, synchronization folders, or removable media with additional caution because their .git configuration may remain intact.
Key Takeaway
The vulnerabilities show that AI coding agents can inherit security risks from the tools they use underneath the AI layer.
The problem is not necessarily the AI model itself. Automated Git operations performed in the background can become an attack vector when repository supplied configuration is trusted without sufficient validation.
As AI coding agents become more automated, developers should treat untrusted repositories as potentially executable content and ensure that Git configuration and agent permissions are properly restricted.
SEO Meta Description:
Security researchers found Git configuration vulnerabilities in AI coding agents including Codex, Claude Code, goose, Hermes Agent, Qwen Code, Grok Build, and Cursor that can execute malicious commands outside agent sandboxes.
