Manifold Security has disclosed eight security flaws across seven command-line AI coding agents, including Claude, Codex, and Cursor. The vulnerabilities allow a malicious Git configuration file within a repository to name a command that the AI agent will execute on the developer's machine. The execution occurs as the user, bypassing the agent's sandbox and without triggering any approval prompt. Exploitation requires only that the malicious repository be cloned or opened by the developer. At the time of publication, four of the eight flaws remained unpatched. This class of vulnerability represents a supply chain and social engineering risk, as developers may unknowingly run attacker-controlled code simply by interacting with a repository. The attack surface is broad, affecting multiple widely-used AI-assisted development tools.
Manifold Security (dubbed 'GitSpawn') disclosed eight security flaws across seven AI coding agents that can be exploited via malicious Git repository configurations. The attack vector abuses the Git 'core.fsmonitor' setting, a legitimate Git performance feature whose value is a shell command that Git executes to identify changed files. Git reads this setting from the repository's own .git/config file. When an AI coding agent opens a repository and runs background Git operations (such as 'git status' or 'git diff') to determine the current branch and changed files, it inadvertently executes the attacker-controlled command specified in core.fsmonitor. The command executes with the user's privileges, outside the agent's sandbox, and without any user approval prompt. Exploitation requires the repository to arrive with its .git directory intact (e.g., via shared archive, shared drive, sync folder, or USB stick — not via ordinary git clone). On Claude Code and Hermes Agent, the payload fires before the workspace-trust prompt is accepted; on Qwen Code, before authentication; and on Grok Build, on the first keystroke. A second Claude Code attack path exists through 'claude ultrareview' using a different, undisclosed Git configuration key. Five of Manifold's eight reports were duplicates of independently filed findings. Cobalt's red-team research notes that FSMonitor abuse exploits a legitimate feature, not a bug, leveraging the intersection of Git's flexibility and IDE automation to turn a repository open event into code execution. The vulnerability class previously affected Visual Studio Code (CVE-2021-43891) and JetBrains IDEs (CVE-2022-24346).
1. Inspect .git/config before opening a received directory with an AI agent — look for core.fsmonitor, core.hooksPath, and attr.tree entries alongside clean or process filter values. 2. Run 'git config --get core.fsmonitor' inside any repository that arrived as files to check for malicious settings. 3. Run 'git config --global --list | grep fsmonitor' to audit the global Git configuration. 4. Set 'git config --global core.fsmonitor false' to disable the setting globally by default. 5. Update to patched versions: goose 1.44.0+, Codex CLI 0.131.0+, Codex Desktop for macOS 26.519.22136+, Codex Desktop for Windows 26.519.21041+, Claude Code 2.1.196+ (note: ultrareview path may still be unpatched). 6. Vendors shipping agents should strip the configuration on background Git calls, e.g., 'git -c core.fsmonitor=false status'. 7. Avoid opening repositories received via file archives, shared drives, sync folders, or USB sticks with an AI agent without first auditing the .git/config. 8. Installations of Codex CLI pinned below 0.131.0 remain exposed — update immediately. 9. For Hermes Agent, Qwen Code, and Grok Build — no fix is currently available; apply manual mitigations and avoid opening untrusted repositories with these agents.
.git/config containing core.fsmonitor key with shell command value, .git/config containing core.hooksPath key, .git/config containing attr.tree key, .git/config containing clean or process filter entries, Repositories received as file archives or via shared drives/USB with .git directory intact
