Git Config Poisoning Bypasses AI Coding Agent Sandboxes — Four Agents Still Unpatched

As reported by The Hacker News, Manifold Security's disclosure of eight vulnerabilities across seven AI coding agents exposes a fundamental blind spot in how these tools interact with the Git plumbing beneath them. The attack vector — core.fsmonitor in a repository's own .git/config — is not novel. What is novel is that AI coding agents, in their rush to provide seamless developer experience, are silently executing repository-supplied commands before any trust prompt, authentication check, or sandbox boundary takes effect.

The significance here extends well beyond the individual CVEs. This is an entire class of vulnerability that Manifold describes as present in more agents than they named. The root cause is architectural: AI coding agents spawn subprocesses like git status and git diff at session startup to orient themselves in the workspace. Git dutifully reads core.fsmonitor from the local repository's config and executes whatever command string is there. The agent never inspects or sanitizes that configuration value — it simply inherits whatever Git does.

Affected Products and Patch Status

CVE-2026-19592 carries a High severity rating per OpenAI's advisory. The remaining CVEs from Manifold's disclosure and OpenAI's additional two CVEs for Codex were published the same day. Active exploitation in the wild has not yet been observed, but the low barrier to entry — a single line in a config file — makes wide adoption by threat actors probable once details circulate.

Why This Matters Beyond the CVEs

The attack chain is elegantly simple. An attacker crafts a repository with a malicious core.fsmonitor value, distributes it via archive, shared drive, sync folder, or USB — not a standard clone, which strips the .git directory — and waits. When a developer opens the project in an affected AI agent, the payload fires before the user has any opportunity to review, approve, or even see what is happening. On Claude Code and Hermes Agent, it executes before the workspace-trust prompt. On Qwen Code, before authentication. On Grok Build, on the first keystroke.

The implications for supply chain security are severe. Organizations that have embraced AI-assisted development — which at this point is most of them — are now operating with an implicit assumption that their AI tooling treats untrusted repositories with the same caution as a modern IDE. That assumption is wrong. These agents are executing untrusted code paths with the developer's full privileges, including access to SSH keys, environment variables, cloud credentials, and proprietary source code.

Who Is Most at Risk

Shield53 Recommendations

Immediate Actions

• Patch all patched agents immediately. Upgrade Goose to 1.44.0+, Codex CLI to 0.131.0+, Codex Desktop to the fixed builds, Cursor to its latest version, and Claude Code to 2.1.196+. Note that Claude Code's second vulnerable path remains unpatched.
• Suspend use of unpatched agents — Hermes Agent, Qwen Code, and Grok Build — on any developer workstation until fixes are available. If suspension is not feasible, enforce strict repository provenance controls.
• Deploy Git config hardening. Add a global Git hook or wrapper that strips or overrides core.fsmonitor from any repository-level config before the agent's subprocess runs. Example: git config --local --unset core.fsmonitor executed as a pre-open script.
• Block .git directory persistence at the file-sharing layer. Configure DLP and endpoint controls to flag or strip .git directories from archives arriving via email, shared drives, and sync folders.

Detection Guidance

• Monitor for unexpected child processes spawned by AI coding agents — particularly git subprocesses that launch binaries outside standard Git tooling paths
• Enable process auditing (Sysmon on Windows, exec audit on Linux/macOS) and alert on any process tree where an AI agent binary spawns a shell or script interpreter
• Scan repositories for suspicious core.fsmonitor entries before opening. A simple pre-commit or pre-open scan: git config --local --get core.fsmonitor and alert if the value is non-empty

Strategic Recommendations

AI coding agents must be treated as untrusted execution surfaces, not as enhanced text editors. Every subprocess they spawn inherits the developer's full privilege set. Security teams should extend application allowlisting and child process restrictions to these tools immediately.

• Extend EDR coverage to developer workstations with rules specifically targeting AI agent process trees
• Adopt a zero-trust model for AI-assisted development: no repository is trusted until scanned, and no agent subprocess executes outside a constrained sandbox
• Establish an AI tooling security review process. Every new AI coding agent adopted by the organization should undergo a subprocess audit before deployment
• Engage vendors on their sandboxing architecture. The fact that multiple independent research groups found the same vulnerability class simultaneously signals that the industry has not been asking the right questions

This disclosure is likely the first of many. Manifold explicitly states they found the pattern in more agents than they named, and three separate research groups independently reported the same class to OpenAI. Organizations should assume any AI coding agent not yet audited for this pattern is vulnerable until proven otherwise.