# Critical Security Flaws in AI Coding Tools Git configurations can allow attacker code to run on developers' machines. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-09-02 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/a986e237-962a-4508-b024-d15b4f03ed70 ## Discovery of Security Vulnerabilities Manifold Security discovered eight security flaws across seven command-line AI coding agents. These vulnerabilities allow a repository's Git configuration to specify a command that the agent runs on the developer's machine. Four of the flaws remained unpatched at the time of publication. The command executes with user privileges outside the agent's sandbox and without an approval prompt. ## Attack Vector Exploitation requires the repository to arrive with its .git directory intact as files. Shared archives, shared drives, sync folders, or USB sticks can preserve this state, while ordinary cloning does not. OpenAI published three CVEs covering the same class of vulnerabilities in Codex. Attacker-controlled code can read, modify, or delete user files and access other account resources. ## Affected Tools and Status Fixes have been released for goose, Claude Code, and Cursor. Hermes Agent, Qwen Code, Grok Build, and a second path in Claude Code were still executing repository-supplied commands when retested by Manifold on September 1. GitHub assigned CVE-2026-72718 a CVSS 4.0 base score of 7.0, credited to Francisco Rosales. This is the only score any of these findings carries. ## Role of Git Configuration core.fsmonitor is a Git performance setting whose value is a command that Git runs to identify changed files. Git reads this from the repository's own .git/config. Any operation refreshing the index, including git status and git diff, executes this command. Agents call these commands in the background to determine the current branch and changed files. ## Discovery Process and Other Research Manifold published the findings as GitSpawn and detailed five of the eight vulnerabilities. They also found the pattern in more agents than named. Sonar reported the same issue in April, noting Anthropic had modified the startup sequence to close it. They identified the same trust-dialog bypass in pre-1.63.1 Visual Studio Code and pre-2021.3.1 JetBrains IDEs. ## Claude Code Update History Version 2.0.34 of Claude, released November 5, 2025, mitigated a specific vulnerability by no longer running git status before user trust approval. However, a related issue persisted. Manifold reported the same startup behavior reappeared in version 2.1.193, released June 25, 2026. Anthropic had previously disclosed pre-trust execution flaws in Claude Code. ## Other Affected Tools and Responses Alibaba's security response center accepted the Qwen Code report on July 7. Nous Research's Hermes Agent was run unattended during a July intrusion against a Thai government network. xAI closed an earlier report of the same class as informative on July 1 and marked Manifold's July 14 report as a duplicate. Separate research found Grok Build uploading entire Git repositories to xAI storage. ## Overall Status and Risk Assessment No sources report exploitation of these findings. None of the CVEs appear in the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog as of September 1, 2026. FSMonitor abuse exploits a legitimate feature, not a bug, leveraging the intersection of Git's flexibility and modern development tool automation. This creates unexpected execution paths outside intended security boundaries. ## Sources covering this story - https://thehackernews.com/2026/09/malicious-git-configs-can-make-claude.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._