Open a folder with Claude Code and it runs `git status` before you type anything. Before the workspace-trust prompt. On some agents, before you have even authenticated.
If that folder came from somewhere else, the repository decides what that command runs.
Six high-severity findings across five agents. Two are patched and four are not.
TL;DR
What it is. AI coding agents run git commands in the background to gather context, on some agents before you type a prompt, before the workspace-trust prompt, before you have even authenticated. Improper sanitization in this context-gathering mechanism is a widespread security vulnerability across AI coding agent products, each ending in arbitrary code execution.
What an attacker gets. Arbitrary code execution as the developer, outside the sandbox, with no approval prompt and nothing on screen. Their SSH keys, the cloud credentials in their environment, the tokens in their shell config, every repository on disk, and a foothold on the machine.
How widespread. Not one vendor’s bug. Claude Code ships over 77 million npm downloads a month (as per npm API). Across the five projects, Hermes carries over 237,000 GitHub stars, Claude Code 143,000+, Goose 54,000+, Qwen Code 27,000+ and Grok Build 26,000, close to half a million together.
On publishing unpatched. Four of the six findings are still live. Every one was reported privately, re-confirmed on a current release before publication, and either acknowledged by the vendor or chased across multiple channels without reply. Two of our reports came back as duplicates of findings other researchers had already filed independently, one on the same day as ours. This is being found from more than one direction.
One question
This research began with a single question: what does a CLI AI agent actually do when it starts up? What happens under the hood?
Upon looking at several AI agents, we observed the same behaviour, they gather context about the project they have just been opened in. A good part of that gathering is done with git, called for different purposes at different moments, some on start-up, some once the session begins.
Looking at how git is used, we found a vulnerable pattern. Those context-gathering calls ran without stripping the repository's own git configuration, and several git settings are command execution sinks. The repository names a command, git runs it, on the host, with the user's privileges, before any approval prompt.
This post covers only a few of them, Claude Code, Goose, Grok Build, Hermes and Qwen Code. We found it in more agents than we name here.
The git you didn't run
What an agent asks git for depends on what it is trying to do. It might want the current branch, and which files have been modified or staged. It might want the files a change touched, or every path the repository tracks, or a fresh worktree for a sub-agent to work in.
Two samples out of many, from different products:
git status --porcelain=2 --branch
git diff --name-only HEAD
Neither is unusual. Both are the sort of command you would write yourself. And both, like most git commands that touch the working tree, make git refresh its index first.
That refresh is the sink.
core.fsmonitor is a performance setting for large repositories. Instead of checking every file on disk, git asks a helper program what changed, and runs it during an index refresh. Documented, intended behaviour.
Git reads that setting from the repository's own .git/config. So a repository can ship this:
[core]
fsmonitor = <command>
and any git command that refreshes the index runs it: git status, git diff. Which one the agent chose does not matter. And core.fsmonitor is not the only setting of its kind, which is why one of the findings below is not a core.fsmonitor bug at all.
Delivery is worth being precise about, because git never carries this. Cloning a hostile URL does nothing, and neither does fetch or pull. The repository has to arrive as files with its .git directory already inside, so the vector is anything that moves a directory instead of cloning it: a shared .zip, a shared drive, a sync folder, a USB stick. Colleagues pass projects around this way, consultants hand them to clients. For every proof of concept in this post, we used a .zip.
From there the command runs as you, with your privileges, on your machine. This is the agent's own code spawning a subprocess to use git, so the command runs outside the sandbox, without an approval prompt. The permission model never sees it.
We call it GitSpawn. Below are examples of what we found, in different CLI AI agents.
Want to see what you agents actually do at runtime? Talk to Manifold.
The same mistake, agent by agent
Goose
The sink. goose built the diff for a review by running git diff inside the repository. It handed git one config flag, core.quotePath=off, and stripped none. The index refreshed, the repository's core.fsmonitor command ran, before goose contacted the model.
The trigger. A user ran goose review to get a code review of their working changes, and the payload executed while the command gathered the diff.
Affected 1.41.0 (reported 13 July), fixed in 1.44.0. CVE-2026-72718, scored 7.0 (severity) by the maintainers, assigned after our report.
Claude Code - core.fsmonitor
The sink. Claude Code gathered repository context at startup by running git status as an internal subprocess, outside its sandbox. It stripped nothing from the repository's config. The index refreshed, the repository's core.fsmonitor command ran on the host, before the workspace-trust prompt was accepted.
The trigger. A user opened a project folder with claude, and the payload executed while the agent gathered its context.
Confirmed on 2.1.193, fixed by 2.1.196. Reported 26 June 2026, closed as a duplicate of a report filed earlier the same day.
Claude Code - ultrareview
The sink. This one is not core.fsmonitor. It is a different git setting of the same kind, one the review path does not strip. The malicious command runs on startup, even before the workspace-trust prompt is shown or accepted.
The trigger. A user runs claude ultrareview to get a review of the repository they are in, and the payload executes before the review starts.
Reported 15 July 2026 on 2.1.210, closed as a duplicate of internal ticket. Confirmed still unpatched on 2.1.252 on 1 September.
Hermes Agent
The sink. Hermes runs git status in the session directory to gather the repository context. It passes the repository's config through untouched. The index refreshes, the repository's core.fsmonitor command runs on the host.
The trigger. A user opens a repository with Hermes and sends their first message, and the payload executes as Hermes gathers that context.
Confirmed on 0.18.2 on 19 July 2026, reported the next day, and confirmed again on 0.21.0 on 1 September. Six contact attempts across five channels, the private GHSA advisory was never triaged. CVE-2026-71963, assigned by VulnCheck, an independent CVE Numbering Authority, not the vendor. Still unpatched.
Qwen Code
The sink. Qwen Code runs git status when it starts, to gather the repository context. It passes the repository's config through untouched. The index refreshes, the repository's core.fsmonitor command runs on the host.
The trigger. A user opens a folder with qwen, and the payload executes on start-up, even before the user has authenticated.
Confirmed on 0.19.6, reported 7 July 2026 to Alibaba's security response centre and accepted. Confirmed again on 0.22.3 on 1 September. Remains unpatched.
Grok Build
The sink. Grok Build runs git to gather the repository context. It passes the repository's config through untouched. The index refreshes, the repository's core.fsmonitor command runs on the host.
The trigger. A user opens a repository with Grok Build and begins typing a prompt, and the payload executes on the first keystroke, before any message is sent.
Confirmed on 0.2.93. An earlier report of the same class, filed 1 July 2026 was closed as informative. Ours followed on 14 July and was closed as a duplicate of it. Confirmed again on 1.0.13 on 1 September. Remains unpatched.
Timeline table
| Agent | Reported | Vendor response | Status at publication |
|---|---|---|---|
Claude Code (core.fsmonitor) | 26 June 2026 | Closed as duplicate of a same-day report | Patched – 2.1.196 |
| Qwen Code | 7 July 2026 | Accepted by Alibaba SRC | Unpatched – confirmed 0.22.3 |
| Goose | 13 July 2026 | Acknowledged, CVE assigned | Patched – 1.44.0, CVE‑2026‑72718 |
| Grok Build | 14 July 2026 | Closed as duplicate of a 1 July report xAI had closed as informative | Unpatched – confirmed 1.0.13 |
Claude Code (ultrareview) | 15 July 2026 | Closed as duplicate of internal ticket | Unpatched – confirmed 2.1.252 |
| Hermes | 20 July 2026 | No triage after six contacts across five channels | Unpatched – confirmed 0.21.0; CVE‑2026‑71963 assigned |
Every finding here was reported privately. Two have since been fixed, and each one still unpatched was re-confirmed against a current release before publication. We found the same flaw in other agents not named here. We have deliberately kept the detail minimal. Each section gives the sink, the trigger, and a recording, and the mechanism is explained above. What we are not publishing is a ready-made repository anyone could point at a colleague, and for the one finding that turns on a different config key we have left that key unnamed while it remains unpatched.
What to do about it
If you receive a repository as files. Inspect .git/config before you open the directory with an agent. Any setting that names a program can run it.
If you ship an AI coding agent. Sanitize the git config on the context-gathering calls your product makes in the background, for example git -c core.fsmonitor=false status
The answer
At the beginning of this research we asked what a CLI AI agent actually does when it starts up. One of the mechanisms that fires is context gathering, and it runs in the background. The agents use git to do it, on some before you type anything, before you accept the workspace-trust prompt, before you have even authenticated.
The vulnerability is not in the model, or in anything new. It is in the ordinary plumbing underneath, the subprocess an agent spawns at session startup to work out where it is. Every agent we looked at in this article had some version of that same flow, unsanitized. That is what makes this widespread rather than one vendor’s mistake.
AI coding agents are here to stay. Millions of people use them now, technical and non-technical alike, adopted for their power and efficiency. Making them secure will take continued research, and it starts with understanding what they do on the machine where they run.
How Manifold helps
Coding agents do not just answer questions. They run tools, spawn processes, and act on endpoints with the privileges of whoever launched them, which is the point of running one. That is a layer the existing controls were not built for. EDR sees familiar developer tooling doing familiar things. The gateway sees authenticated traffic it already allows. Neither has a view of what the agent itself decided to do.
The same shape shows up wherever an agent picks up something it did not write. Skills, MCP servers, and plugins arrive as files, carry their own configuration, and are trusted on arrival for the same reason a repository is. The artifact changes, the pattern does not.
Manifold watches that layer: what agents actually do at runtime, not what their permissions say they can. Talk to Manifold.
Latest articles
