Git config flaws let malicious repos run code in AI coding agents

Manifold Security has disclosed eight security flaws in seven command-line AI coding agents, in which a repository’s own Git configuration can make the agent run attacker-controlled commands on the developer’s machine. Four of the flaws remained unpatched at publication.

The issue affects goose, Claude Code, Cursor, Hermes Agent, Qwen Code, Grok Build and Codex. Fixes have shipped for goose, Claude Code and Cursor, while the others were still vulnerable when retested on September 1. OpenAI published three CVEs for the same class in Codex.

The attack works because Git reads settings such as core.fsmonitor from the repository’s own .git/config, and the agents run Git commands in the background without an approval prompt. Exploitation requires the repository to arrive with its .git directory intact, which a shared archive or USB stick preserves, whereas a normal clone does not.

Manifold reported the findings as GitSpawn. No exploitation has been reported, and none of the CVEs appear in CISA’s Known Exploited Vulnerabilities catalog.