Critical Vulnerability in AI Agents Enables Code Execution via Malicious Git Config
Manifold Security has disclosed eight critical security vulnerabilities across seven AI coding agents that exploit Git configuration to execute arbitrary code on developers' machines. Affected products include goose, Claude Code (Anthropic), Cursor, Hermes Agent, Qwen Code (Alibaba), Grok Build (xAI), and Codex (OpenAI). Collectively termed GitSpawn, these vulnerabilities allow malicious repositories to execute commands with user privileges, outside the agent's sandbox, and without approval prompts. OpenAI published CVE-2026-19592 for Codex, while GitHub assigned CVE-2026-72718 with a CVSS 4.0 base score of 7.0 for goose.
The attack technique exploits Git's core.fsmonitor parameter, a performance setting whose value is a command that Git runs to identify changed files. When AI agents execute git status or git diff to determine the current branch and modified files, they also invoke this malicious command configured in the repository's .git/config file. Exploitation requires the repository to arrive with its .git directory intact, preserved in shared archive files, sync drives, or USB devices, unlike an ordinary clone that excludes this directory.
Full patches have been deployed for goose, Claude Code, and Cursor, while Hermes Agent, Qwen Code, Grok Build, and a second attack pathway in Claude Code remained vulnerable as of September 1. Alibaba and xAI maintain open cases, while Nous Research did not triage the Hermes Agent report despite six contact attempts. The attack pattern was previously documented in VS Code (CVE-2021-43891) and JetBrains IDEs (CVE-2022-24346), demonstrating this vulnerability class is a recurring issue in development tools.
The research underscores that the vulnerability lies not in the AI model but in the "ordinary plumbing underneath": the subprocess an agent spawns at startup to determine its environment. Researchers emphasize this is abuse of a legitimate Git feature, not a bug, exploiting the intersection between Git's flexibility and modern IDE automation. No active exploits have been reported, and none of the CVEs appear in CISA's KEV catalog. Codex CLI users must update to version 0.152.1, as installations below 0.131.0 remain exposed.