Malicious .git configs can make Claude Code, Codex, and Cursor run attacker code

Two independent security research efforts disclosed this week that nearly every major AI coding agent — including Claude Code, OpenAI's Codex, Cursor, and several others — could be tricked into running attacker-controlled commands outside their own sandboxes, simply by opening a booby-trapped code repository. Neither disclosure describes a flaw in the underlying AI models themselves; both point to the same overlooked layer: the ordinary background commands these agents run to figure out where they are before you've even typed a prompt.

The git config trick

Security firm Manifold Security published the more technical of the two disclosures, naming it GitSpawn: eight flaws across seven command-line coding agents, four still unpatched at publication. The exploit abuses core.fsmonitor, an ordinary Git performance setting stored in a repository's own .git/config file that tells Git which external command to run to detect changed files. Any routine operation that refreshes the index — git status, git diff, even an agent silently checking which branch it's on — triggers that command. If an attacker ships a repository with a malicious .git/config already intact (via a shared drive, sync folder, USB stick, or extracted archive, none of which strip the config the way a normal git clone does), the agent executes the attacker's command with the user's own privileges, outside the sandbox, with no approval prompt.

The timing is what makes it dangerous: on Claude Code and Hermes Agent, the payload fires before the workspace-trust prompt is ever shown. On Qwen Code, it fires before the user has even authenticated. On Grok Build, Manifold says it fires on the first keystroke. OpenAI published three separate CVEs for Codex covering the same flaw class the same day, credited to three unrelated research groups working independently — a strong signal this is a structural pattern in how coding agents are built, not one team's one-off mistake. As of Manifold's September 1 retest, goose, Claude Code, and Cursor had shipped fixes; Hermes Agent, Qwen Code, Grok Build, and a second affected code path in Claude Code had not.

A separate disclosure, the same underlying problem

A second, less technical disclosure came from Accomplish, a still-stealthy startup founded by Or Hiltch, Amit Avner, and Guy Zipori. Accomplish's finding is broader in framing: rather than one specific exploit chain, the founders argue that leaky sandboxes are a structural feature of how these agents are built, not an edge case. Their point is that the sandbox itself often works exactly as designed — the AI agent stays contained — but the files that agent produces inside the sandbox get handed off afterward to trusted software running outside it, and that handoff is where attacker-controlled content slips through. "The vulnerability is not in the model, or in anything new," Manifold put it similarly of GitSpawn. "It is in the ordinary plumbing underneath."

Vendor response times varied sharply, according to Accomplish's account: Cursor and OpenAI shipped fixes in about a week of being notified. Anthropic took roughly 50 days and 30 released versions before patching the issue Accomplish had flagged.

Why this matters beyond one bug list

AI coding agents have moved fast from autocomplete tools to systems that clone unfamiliar repositories, run test suites, and execute shell commands with minimal human review — often the entire selling point is that they act before you ask. That autonomy is exactly what both disclosures exploit: the agents are triggering trust-sensitive operations (reading a repo's config, determining branch state) as routine background housekeeping, before any of the safeguards meant to gate risky actions — workspace-trust prompts, authentication, explicit approval — have had a chance to fire.

Developers who work with untrusted or third-party repositories — cloning a contributor's fork, opening a bug-bounty submission, extracting a shared archive — should treat any of the still-unpatched agents (Hermes Agent, Qwen Code, Grok Build) as executing arbitrary code on open, before review. For patched agents, updating to the fixed versions Manifold documented (goose 1.44.0+, Codex CLI 0.131.0+, Claude Code 2.1.196+ for the core.fsmonitor path specifically) closes the disclosed vector — but both research teams stress this is a pattern, not a single bug, and more variants are likely to surface as agents keep adding background operations that run before the user is asked anything at all.

As first reported by The Hacker News and Manifold Security.