Git Turned into a Trap: Seven AI Agents Can Execute Code from Repositories

Eight Vulnerabilities in Assisted Development Tools

On September 2, 2026, a class of vulnerabilities affecting seven command-line AI software development agents came to light. Under certain conditions, an attacker-controlled repository can cause these tools to execute arbitrary commands on the host.

Eight flaws were identified across goose, Codex, Claude Code, Hermes Agent, Qwen Code, Grok Build, and Cursor. The issue does not depend on malicious prompts, model jailbreaks, or permissions granted to AI tools. Instead, execution occurs when the agent automatically invokes Git to rebuild the project context.

The attacker’s command runs with the privileges of the local user, outside the agent’s sandbox and without requiring confirmation. It can therefore read, modify, or delete files, use account credentials, and access secrets stored in environment variables, including API keys.

In some products, the payload runs before the user marks the workspace as trusted. In others, it executes before authentication, on the first keystroke, or even before the agent contacts the language model.

No attacks exploiting these vulnerabilities have been observed. None of the CVEs discussed appears in CISA’s Known Exploited Vulnerabilities catalog, so there is no associated federal remediation deadline.

The Command Hidden in .git/config

The primary attack vector is core.fsmonitor, a legitimate Git option designed to speed up detection of modified files. Its value can specify an external command that Git executes during certain index operations.

A malicious repository may contain a configuration such as:

[core]
    fsmonitor = <command>

The entry is stored in the local .git/config file. When an agent runs background operations such as git status or git diff, Git reads the configuration and may launch the command specified by the attacker.

The AI model is not part of the execution chain. The flaw results from the interaction between a highly flexible Git feature and the automation introduced by coding assistants.

However, the repository must reach the victim with its .git directory intact. Possible delivery channels include compressed archives, synchronized folders, shared drives, USB sticks, mounted volumes, nested repositories, and checkouts produced by CI pipelines.

A standard git clone does not preserve the malicious local configuration in the form required for this attack. The greatest risk therefore concerns projects received as complete directories or extracted from archives, rather than repositories cloned through the usual Git workflow.

The agent’s trust barriers come too late. In Claude Code and Hermes Agent, the command may run before the workspace is accepted; in Qwen Code, it may execute before authentication. Grok Build can trigger it on the first keypress, while goose may run it before contacting the model.

Vulnerable Versions and Available Updates

The patch status varies significantly across the seven products.

Product	Affected or tested versions	Fix and status
goose	All versions before 1.44.0; tested on 1.41.0	Fixed in 1.44.0
Codex CLI	From 0.102.0 through 0.130.0	Fixed in 0.131.0
Codex Desktop for macOS	From 260202.0859 through 26.513.31313	Fixed in 26.519.22136
Codex Desktop for Windows	From 26.304.38 through 26.513.40821	Fixed in 26.519.21041
Codex Microsoft Store	From 26.304.38.0 through 26.513.4821.0	Fixed in 26.519.2081.0
Claude Code, FSMonitor path	2.1.193 confirmed vulnerable	Fixed in 2.1.196
Claude Code, ultrareview	Confirmed on 2.1.252	Status of later releases unknown
Hermes Agent	0.18.2 and 0.21.0	No fix available in the reported tests
Qwen Code	0.19.6 and 0.22.3	No fix available
Grok Build	0.2.93 and 1.0.13	No fix available
Cursor CLI	Exact versions not disclosed	Fix available; version not specified

In goose, tracked as CVE-2026-72718, the goose review command uses the Git binary installed on the system. The functions responsible for gathering context run git diff --name-only HEAD and git diff HEAD without disabling core.fsmonitor.

The vulnerability is rated High, with a CVSS v4 score of 7.0/10 and a CWE-94 classification. The corresponding advisory, GHSA-r5pp-p5r8-466r, was published on July 24 and credits Francisco Rosales of Manifold Security with the discovery.

OpenAI published three CVEs for Codex, reported by three independent research groups. In CVE-2026-19592, the helper process runs outside the sandbox and without approval. The flaw has a CVSS 3.1 score of 7.3. Although the current Codex CLI version tested was 0.152.1, installations pinned below 0.131.0 remain exposed.

Claude Code Has Two Separate Attack Paths

Claude Code requires separate analysis because two attack mechanisms were identified.

The first exploits core.fsmonitor: it was reproducible in version 2.1.193 and fixed in 2.1.196. The report was submitted on June 26 and the patch arrived on June 29, but the case was closed as a duplicate of an earlier report received the same day.

The second path goes through claude ultrareview and uses a different Git configuration key, which has not been disclosed. The attack worked on 2.1.252; the most recent comparison was conducted against 2.1.258, without determining whether a later release eliminated the issue.

Anthropic had already addressed pre-trust behavior. Version 2.0.34 changed startup behavior to prevent git status from running before workspace approval, but a related behavior reappeared in 2.1.193.

CVE-2026-55607, also rated 8.8 CVSS, involves Git FSMonitor execution during worktree operations. No dedicated advisory has been published covering both newly described Claude Code paths.

How to Check a Repository Before Opening It

The first precaution is to treat project directories received with an existing .git directory as untrusted. Before launching an AI agent, check the local FSMonitor value:

git config --get core.fsmonitor

The global configuration can be checked with:

git config --global --list | grep fsmonitor

You should also inspect .git/config manually for at least:

• core.fsmonitor;
• core.hooksPath;
• attr.tree;
• clean filters;
• process filters.

The presence of these options does not automatically indicate an attack. Their values must nevertheless be reviewed carefully, especially when they invoke scripts, interpreters, binaries, or paths outside the repository.

If FSMonitor is not needed, it can be disabled globally:

git config --global core.fsmonitor false

Agent developers should explicitly neutralize repository-controlled configuration during every automated Git invocation. For FSMonitor, a defensive call could look like this:

git -c core.fsmonitor=false status

However, this option alone is not enough. Git hooks, attributes, and filters can also alter the behavior of automated processes and must be included in the security model.

Immediate Patches, but Some Products Remain Exposed

goose users should install at least 1.44.0. Codex CLI should be upgraded to at least 0.131.0, while the desktop applications must reach the corrected builds specific to macOS, Windows, or the Microsoft Store.

For Claude Code, 2.1.196 closes the core.fsmonitor path, but it does not establish that the ultrareview vector has also been resolved. Hermes Agent, Qwen Code, and Grok Build were still vulnerable in the latest versions tested. A fix is available for Cursor, but the affected builds are unknown.

The technique is not new: similar issues were fixed in Visual Studio Code before 1.63.1 under CVE-2021-43891, and in JetBrains IDEs before 2021.3.1 under CVE-2022-24346. Both have a CVSS score of 7.8.

Over the past 90 days, CISA has also added vulnerabilities affecting Anthropic, Microsoft, and JetBrains to the KEV catalog: CVE-2019-1068 on August 26, 2026; CVE-2026-33824 and CVE-2026-55040 on August 18, 2026; CVE-2026-68820 on August 11, 2026; CVE-2026-63077 on August 5, 2026; and CVE-2026-50522 on July 22, 2026. The Git flaws affecting the AI agents described here, however, do not appear in the catalog.

The absence of KEV listings and documented compromises does not eliminate the technical risk. Opening the wrong directory with a vulnerable agent is enough: the code may execute before any AI safeguard or trust dialog has a chance to intervene.