A malicious .git turns AI agents into runners of someone else's code

Manifold Security has published a study called GitSpawn describing eight vulnerabilities across seven console AI coding agents. The gist is the same for all of them: using its own Git configuration, a repository specifies a command that the agent obediently runs on the developer's computer. The command executes with the user's privileges, outside the agent's sandbox and without any confirmation prompt — meaning it can read, modify and delete the victim's files.

Where the hole hides

According to the researchers, the problem lies not in the model or in anything new, but “in the ordinary plumbing under the hood” — in the subprocess the agent launches at the start of a session to figure out where it is. The core.fsmonitor key is a Git performance setting whose value is a command for detecting changed files. Git reads it straight from the repository's .git/config, and any operation that updates the index (including git status and git diff) runs that command. Agents invoke such commands in the background to learn the current branch and the list of changes — and they never touch the repository's configuration.

An important caveat: an ordinary clone does not carry the setting over. The attack works only if the repository arrives as ready-made files with a preserved .git directory — via a shared archive, a network drive, a sync folder or a USB stick.

Who has already fixed it, and who hasn't

Patches have been released for goose, Claude Code and Cursor. As of a re-check on September 1, code from the repository was still being executed by Hermes Agent, Qwen Code, Grok Build and a second path in Claude Code reachable via claude ultrareview. Moreover, with several of the agents the malicious payload fires before the workspace trust dialog is accepted (Claude Code, Hermes), before the user authenticates (Qwen Code), or on the very first keystroke (Grok Build).

That same day OpenAI issued three CVEs of its own for Codex, tied to the same class of problems. The recurrence is telling, too: Sonar reported the same thing back in April, noting that Anthropic had once already rearranged the startup sequence to close the gap — and that in version 2.1.193 the old behavior returned. The same trick for bypassing the trust dialog had previously been found in Visual Studio Code and in JetBrains IDEs.

No cases of exploitation in real-world attacks have been recorded so far, and none of the CVEs has made it into CISA's catalog of actively exploited vulnerabilities.

What to do

Before opening a folder received from outside in an agent, it's worth looking into .git/config and checking core.fsmonitor, core.hooksPath and attr.tree. The command git config --get core.fsmonitor will show the value inside the repository that arrived, while git config --global core.fsmonitor false will disable the setting by default. Agent developers are advised by the researchers to silence the configuration on background calls — for example, via git -c core.fsmonitor=false status.

Source: The Hacker News