Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code
- ID
- 20696
- Status
- summarized
- Published
- 02 Sep 2026, 10:06 PM
- Fetched
- 02 Sep 2026, 10:17 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/09/malicious-git-configs-can-make-claude.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 8.5
- Created
- 02 Sep 2026, 10:17 PM
- Tags
- Audience
- developersvibe_codersai_agent_users
What happened
Manifold Security disclosed eight flaws across seven CLI AI coding agents (Claude Code, Cursor, Codex, goose, Qwen Code, Grok Build, Hermes Agent) where a repository's .git/config can specify a command via core.fsmonitor that Git runs during index refresh — and the agents trigger git status/git diff at startup, executing attacker-controlled code as the user outside the sandbox with no approval prompt. Four agents (Hermes Agent, Qwen Code, Grok Build, and a second Claude Code path) were still unpatched as of September 1, 2026. The attack requires the repo to arrive with its .git directory intact (shared archive, sync folder, USB stick), not via a normal clone.
Why it matters
If you use Claude Code, Cursor, Codex, or similar CLI agents and you open a project that someone shared as a zip, drive folder, or USB copy rather than a fresh clone, the agent can execute arbitrary code on your machine before you even accept a workspace-trust prompt. Stop opening shared archives in AI coding agents until you've verified the agent is patched, and prefer cloning from remote over copying directories. If you're on Hermes Agent, Qwen Code, or Grok Build, there is no fix yet — treat any non-cloned repo as untrusted.
Discussion angle
Walk through the core.fsmonitor mechanism live: show what a malicious .git/config looks like, demonstrate why a normal clone is safe but a zipped repo is not, and check which agents in the audience's toolchains are still unpatched.