Eight findings across seven agents. Four remain unpatched at publication.
Update, 1 September 2026.OpenAI's Codex and Cursor were also affected. We tested and reported both; each came back as a duplicate of a report another researcher had already filed, and both have since been patched. The Codex variant differs somewhat in mechanism but belongs to the same class. Neither is written up separately below; the case studies cover the findings where we could show the full chain ourselves and where the disclosure record was worth documenting.
Open a folder with Claude Code and it runs git status before you type anything. Before the workspace-trust prompt. On some agents, before you have even authenticated.
If that folder came from somewhere else, the repository decides what that command runs.
TL;DR #
What it is. AI coding agents run git commands in the background to gather context, on some agents before you type a prompt, before the workspace-trust prompt, before you have even authenticated. Improper sanitization in this context-gathering mechanism is a widespread security vulnerability across AI coding agent products, each ending in arbitrary code execution.What an attacker gets. Arbitrary code execution as the developer, outside the sandbox, with no approval prompt and nothing on screen. Their SSH keys, the cloud credentials in their environment, the tokens in their shell config, every repository on disk, and a foothold on the machine.How widespread. Not one vendor’s bug. Claude Code ships over 77 million npm downloads a month (as per npm API). Across the five projects, Hermes carries over 237,000 GitHub stars, Claude Code 143,000+, Goose 54,000+, Qwen Code 27,000+ and Grok Build 26,000, close to half a million together.On publishing unpatched. Four of the eight findings are still live. Every one was reported privately, re-confirmed on a current release before publication, and either acknowledged by the vendor or chased across multiple channels without reply. Five of our reports came back as duplicates of findings other researchers had already filed independently, one on the same day as ours. This is being found from more than one direction.
One question #
This research began with a single question: what does a CLI AI agent actually do when it starts up? What happens under the hood?
Upon looking at several AI agents, we observed the same behaviour, they gather context about the project they have just been opened in. A good part of that gathering is done with git
, called for different purposes at different moments, some on start-up, some once the session begins.
Looking at how git
is used, we found a vulnerable pattern. Those context-gathering calls ran without stripping the repository's own git configuration, and several git settings are command execution sinks. The repository names a command, git runs it, on the host, with the user's privileges, before any approval prompt.
This post covers only a few of them, Claude Code, Goose, Grok Build, Hermes and Qwen Code. We found it in more agents than we name here.
What an agent asks git
for depends on what it is trying to do. It might want the current branch, and which files have been modified or staged. It might want the files a change touched, or every path the repository tracks, or a fresh worktree for a sub-agent to work in. Two samples out of many, from different products:
`git status --porcelain=2 --branch`
`git diff --name-only HEAD`
Neither is unusual. Both are the sort of command you would write yourself. And both, like most git commands that touch the working tree, make git refresh its index first.
That refresh is the sink.
core.fsmonitor
is a performance setting for large repositories. Instead of checking every file on disk, git asks a helper program what changed, and runs it during an index refresh. Documented, intended behaviour.
Git reads that setting from the repository's own .git/config
. So a repository can ship this:
`[core]`
` fsmonitor = <command>`
and any git command that refreshes the index runs it: git status
, git diff
. Which one the agent chose does not matter. And core.fsmonitor
is not the only setting of its kind, which is why one of the findings below is not a core.fsmonitor
bug at all.
Delivery is worth being precise about, because git never carries this. Cloning a hostile URL does nothing, and neither does fetch or pull. The repository has to arrive as files with its .git
directory already inside, so the vector is anything that moves a directory instead of cloning it: a shared .zip
, a shared drive, a sync folder, a USB stick. Colleagues pass projects around this way, consultants hand them to clients. For every proof of concept in this post, we used a .zip
.
From there the command runs as you, with your privileges, on your machine. This is the agent's own code spawning a subprocess to use git, so the command runs outside the sandbox, without an approval prompt. The permission model never sees it. We call it GitSpawn. Below are examples of what we found, in different CLI AI agents.
Want to see what you agents actually do at runtime? Talk to Manifold.
The same mistake, agent by agent #
Goose
**The sink. **goose built the diff for a review by running git diff
inside the repository. It handed git one config flag, core.quotePath=off
, and stripped none. The index refreshed, the repository's core.fsmonitor
command ran, before goose contacted the model.
**The trigger. **A user ran goose review
to get a code review of their working changes, and the payload executed while the command gathered the diff.
**Affected **1.41.0 (reported 13 July), fixed in 1.44.0. CVE-2026-72718, scored 7.0 (severity) by the maintainers, assigned after our report.
Claude Code - core.fsmonitor
**The sink. **Claude Code gathered repository context at startup by running git status
as an internal subprocess, outside its sandbox. It stripped nothing from the repository's config. The index refreshed, the repository's core.fsmonitor
command ran on the host, before the workspace-trust prompt was accepted.
**The trigger. **A user opened a project folder with claude
, and the payload executed while the agent gathered its context.
**Confirmed on **2.1.193, fixed by 2.1.196. Reported 26 June 2026, closed as a duplicate of a report filed earlier the same day.
Claude Code - ultrareview
**The sink. **This one is not core.fsmonitor
. It is a different git setting of the same kind, one the review path does not strip. The malicious command runs on startup, even before the workspace-trust prompt is shown or accepted.
**The trigger. **A user runs claude ultrareview
to get a review of the repository they are in, and the payload executes before the review starts.
**Reported **15 July 2026 on 2.1.210, closed as a duplicate of internal ticket. Confirmed still unpatched on 2.1.252 on 1 September.
Hermes Agent
**The sink. **Hermes runs git status
in the session directory to gather the repository context. It passes the repository's config through untouched. The index refreshes, the repository's core.fsmonitor
command runs on the host.
**The trigger. **A user opens a repository with Hermes and sends their first message, and the payload executes as Hermes gathers that context.
**Confirmed on **0.18.2 on 19 July 2026, reported the next day, and confirmed again on 0.21.0 on 1 September. Six contact attempts across five channels, the private GHSA advisory was never triaged. CVE-2026-71963, assigned by VulnCheck, an independent CVE Numbering Authority, not the vendor. Still unpatched.
Qwen Code
**The sink. **Qwen Code runs git status
when it starts, to gather the repository context. It passes the repository's config through untouched. The index refreshes, the repository's core.fsmonitor
command runs on the host.
**The trigger. **A user opens a folder with qwen
, and the payload executes on start-up, even before the user has authenticated.
**Confirmed on **0.19.6, reported 7 July 2026 to Alibaba's security response centre and accepted. Confirmed again on 0.22.3 on 1 September. Remains unpatched.
Grok Build
**The sink. **Grok Build runs git to gather the repository context. It passes the repository's config through untouched. The index refreshes, the repository's core.fsmonitor
command runs on the host.
**The trigger. **A user opens a repository with Grok Build and begins typing a prompt, and the payload executes on the first keystroke, before any message is sent.
**Confirmed on **0.2.93. An earlier report of the same class, filed 1 July 2026 was closed as informative. Ours followed on 14 July and was closed as a duplicate of it. Confirmed again on 1.0.13 on 1 September. Remains unpatched.
Timeline table #
| Agent | Reported | Vendor response | Status at publication |
|---|---|---|---|
Claude Code (core.fsmonitor ) |
26 June 2026 | Closed as duplicate of a same-day report | Patched – 2.1.196 |
| Qwen Code | 7 July 2026 | Accepted by Alibaba SRC | Unpatched – confirmed 0.22.3 |
| Goose | 13 July 2026 | Acknowledged, CVE assigned | Patched – 1.44.0, CVE‑2026‑72718 |
| Grok Build | 14 July 2026 | Closed as duplicate of a 1 July report xAI had closed as informative | Unpatched – confirmed 1.0.13 |
Claude Code (ultrareview ) |
15 July 2026 | Closed as duplicate of internal ticket | Unpatched – confirmed 2.1.252 |
| Hermes | 20 July 2026 | No triage after six contacts across five channels | Unpatched – confirmed 0.21.0; CVE‑2026‑71963 assigned |
| OpenAI Codex | 20 July 2026 | Closed as duplicate of an earlier report | Patched |
| Cursor | 8 July 2026 | Closed as duplicate of an earlier report | Patched |
Every finding here was reported privately. Four have since been fixed, and each one still unpatched was re-confirmed against a current release before publication. We found the same flaw in other agents not named here. We have deliberately kept the detail minimal. Each section gives the sink, the trigger, and a recording, and the mechanism is explained above. What we are not publishing is a ready-made repository anyone could point at a colleague, and for the one finding that turns on a different config key we have left that key unnamed while it remains unpatched.
What to do about it #
**If you receive a repository as files. **Inspect .git/config
before you open the directory with an agent. Any setting that names a program can run it.
**If you ship an AI coding agent. **Sanitize the git config on the context-gathering calls your product makes in the background, for example git -c core.fsmonitor=false status
The answer #
At the beginning of this research we asked what a CLI AI agent actually does when it starts up. One of the mechanisms that fires is context gathering, and it runs in the background. The agents use git to do it, on some before you type anything, before you accept the workspace-trust prompt, before you have even authenticated.
The vulnerability is not in the model, or in anything new. It is in the ordinary plumbing underneath, the subprocess an agent spawns at session startup to work out where it is. Every agent we looked at in this article had some version of that same flow, unsanitized. That is what makes this widespread rather than one vendor’s mistake.
AI coding agents are here to stay. Millions of people use them now, technical and non-technical alike, adopted for their power and efficiency. Making them secure will take continued research, and it starts with understanding what they do on the machine where they run.
How Manifold helps #
Coding agents do not just answer questions. They run tools, spawn processes, and act on endpoints with the privileges of whoever launched them, which is the point of running one. That is a layer the existing controls were not built for. EDR sees familiar developer tooling doing familiar things. The gateway sees authenticated traffic it already allows. Neither has a view of what the agent itself decided to do.
The same shape shows up wherever an agent picks up something it did not write. Skills, MCP servers, and plugins arrive as files, carry their own configuration, and are trusted on arrival for the same reason a repository is. The artifact changes, the pattern does not.
Manifold watches that layer: what agents actually do at runtime, not what their permissions say they can. Talk to Manifold.
Latest articles