- What: Manifold Security disclosed eight flaws across seven command line AI coding agents in which a repository's .git/config names a command that the agent executes at session startup.
- Impact: The command runs as the logged in user, outside the agent sandbox and with no approval prompt, and on Claude Code, Hermes Agent, Qwen Code, and Grok Build it fires before the trust dialog, before authentication, or on the first keystroke.
- Fix / mitigation: Upgrade goose to 1.44.0 for CVE-2026-72718, Codex CLI to 0.131.0 for OpenAI's three CVEs including CVE-2026-19592, and Claude Code past 2.1.196 for the core.fsmonitor path, but Hermes Agent, Qwen Code, Grok Build, and a second Claude Code path reached through claude ultrareview had no fix as of September 1.
- Who's at risk: Any developer or team that opens a project folder delivered as files with its .git directory intact, from a zip archive, shared drive, sync folder, or USB stick, rather than cloning it fresh.
A repository can hand your AI coding agent a command, and the agent will run it, as you, outside its sandbox, with no approval prompt. Manifold Security disclosed eight flaws of that shape across seven command line AI coding agents on September 2, 2026. Four were still unpatched at publication. On Claude Code and Hermes Agent the attacker code fires before the workspace trust prompt is accepted. On Qwen Code it fires before the user has authenticated. On Grok Build it fires on the first keystroke.
OpenAI published three CVEs of its own the same day covering the identical class in Codex, credited to three unrelated research groups. GitHub assigned CVE-2026-72718 in goose a CVSS 4.0 base score of 7.0, the only score any of these findings carries.
The Sink Is core.fsmonitor
core.fsmonitor is a Git performance setting. Its value is a command, and Git runs that command to identify changed files. Git reads the value from the repository's own .git/config, which means the repository controls it. Any operation that refreshes the index executes it, including git status and git diff.
AI coding agents call exactly those commands in the background at session startup to determine which branch they are on and which files have changed, and they leave the repository's configuration untouched when they do it. Manifold, publishing the research as GitSpawn, put it plainly: the vulnerability is not in the model, or in anything new. It is in the ordinary plumbing underneath, the subprocess an agent spawns at session startup to work out where it is.
goose is the cleanest example. The goose review command builds its Git invocations with one configuration flag, -c core.quotePath=off, and strips nothing else. Running goose review inside a hostile repository runs attacker code with no submitted prompt, no model call, no tool approval, and no trust prompt. The command executes before goose ever contacts the model.
An ordinary git clone does not carry the attacker's .git/config, so this is not a drive by against public repos. Exploitation requires the repository to arrive as files with .git intact, and a shared zip archive, a network drive, a sync folder, or a USB stick all preserve it. Any workflow where a developer receives a project folder instead of cloning it is in scope: customer code drops, forensic artifacts, contractor handoffs, and offline transfers into segmented networks.
Affected Versions
- goose: all versions prior to 1.44.0, fixed in 1.44.0. CVE-2026-72718, CVSS 4.0 base 7.0, credited to Francisco Rosales.
- Codex CLI: 0.102.0 through 0.130.0, fixed in 0.131.0. See CVE-2026-19592.
- Codex Desktop for macOS: 260202.0859 through 26.513.31313, fixed in 26.519.22136.
- Codex Desktop for Windows: 26.304.38 through 26.513.40821, fixed in 26.519.21041. Microsoft Store package 26.304.38.0 through 26.513.4821.0, fixed in 26.519.2081.0.
- Claude Code: core.fsmonitor path confirmed on 2.1.193 and fixed by 2.1.196. A second path, reached through claude ultrareview, confirmed live on 2.1.252.
- Hermes Agent: 0.18.2 and 0.21.0 confirmed, fix pending. CVE-2026-71963 assigned by VulnCheck.
- Qwen Code: 0.19.6 and 0.22.3 confirmed, fix pending.
- Grok Build: 0.2.93 and 1.0.13 confirmed, fix pending.
Four Vendors Have Not Shipped
Manifold retested on September 1. Hermes Agent, Qwen Code, Grok Build, and the second Claude Code path were all still executing repository supplied commands. That second Claude Code path turns on a different Git configuration key that Manifold has withheld, and it was live on 2.1.252 against a current release of 2.1.258. No source states whether the releases since then have closed it.
The vendor responses are the more useful signal for anyone modeling this risk. Alibaba's security response centre accepted the Qwen Code report on July 7, and The Hacker News confirmed via the npm registry on September 2 that 0.22.3, the version Manifold retested, is still the latest published release. xAI closed an earlier report of the same class as informative on July 1, then closed Manifold's July 14 report as a duplicate of the one it had already dismissed. Nous Research left the Hermes Agent advisory untriaged after six contact attempts across five channels, and an operator ran Hermes Agent unattended in an intrusion against a Thai government network in July. Separate research on the same Grok Build 0.2.93 build found the agent uploading whole Git repositories to xAI storage.
The Paper Trail Is Incomplete
Five of Manifold's eight reports came back as duplicates of findings other researchers had filed independently, one of them on the same day. The Claude Code core.fsmonitor report went in on June 26 and was fixed by 2.1.196 on June 29, but it was closed as a duplicate of a report filed earlier that same day, and Anthropic published no advisory for it. The Hacker News confirmed on September 2 that the vendor's published advisory record for the npm package covers neither Claude Code finding. MITRE's CVE List had no published record for CVE-2026-71963 on that date either, even though the identifiers on both sides of it are published VulnCheck records.
Three research groups hit the Codex flaw independently and five of Manifold's eight reports were duplicates, so this class was widely known well before it was widely published. Installed version numbers, not advisories, are the reliable input. Diff your deployed agent versions against the list above and treat a missing advisory as a gap in the record, not evidence you are unaffected.
This Pattern Has a History
Sonar reported the same sink in April and noted that Anthropic had already moved the Claude Code startup sequence once to close it. Version 2.0.34 shipped on November 5, 2025 and stopped running git status before the user approved the trust dialog, but Sonar said a related issue persisted. Manifold reports the same startup behavior present again in 2.1.193, which shipped on June 25, 2026. Anthropic's June advisory for CVE-2026-55607 identifies git fsmonitor execution during worktree operations. Sonar also identified the same trust dialog bypass in Visual Studio Code before 1.63.1, CVE-2021-43891, and in JetBrains IDEs before 2021.3.1, CVE-2022-24346. This is a five year old failure mode landing on new software.
What To Do Now
- Inventory installed CLI agent versions across developer endpoints and upgrade goose to 1.44.0, Codex CLI to 0.131.0, and Codex Desktop to the builds listed above.
- Treat any project folder that arrives with a .git directory as untrusted input. Delete .git and re-clone from the upstream remote, or run git config --list --local and read it before you point an agent at the folder.
- Grep incoming repositories for fsmonitor, sshCommand, pager, and external diff or filter entries in .git/config. The withheld Claude Code key is a reminder that fsmonitor is not the only executable valued setting Git supports.
- For the four unpatched agents, either stop pointing them at repositories you did not clone yourself, or run them in a container with no credentials, no SSH keys, and no cloud tokens mounted.
- Log agent process trees on developer machines. A git subprocess spawning a shell at session startup is a clean detection, and it fires before any model call happens.
The sandbox and approval model these products advertise did not apply here, because the code ran before either was in play. Until the remaining four vendors ship fixes, the boundary you actually control is the file system the agent starts in.
Questions about your exposure?
RedEye Security provides assessments for organizations that need to understand their real risk.
Talk to us