Security researchers at Manifold Security have identified six high-severity security findings across five AI coding agents that can allow attacker-controlled code to run while the agents gather repository information.
The research, published September 1, 2026, covers Claude Code, Qwen Code, Goose, Grok Build and Hermes Agent. Manifold said two of the six findings had been fixed, while four remained unpatched when the research was published.
The common issue is the way the agents use Git in the background. Several agents automatically run Git commands to determine the state of a project, sometimes before a user has entered a prompt, accepted a workspace-trust request or, in one case, authenticated.
Manifold called the vulnerability class GitSpawn. The researchers found that some of these Git calls did not remove repository-controlled configuration before invoking Git.
Git’s official configuration documentation states that core.fsmonitor can point to an external filesystem-monitor command. Git can invoke that command during operations that refresh the index, including git status.
That creates a problem for AI coding agents that automatically run commands such as git status or git diff. A repository’s .git/config can specify an executable command, and Git can run it as part of the background operation.
Manifold said the command executes on the host with the privileges of the developer running the agent. In the affected scenarios described by the researchers, the execution occurs outside the agent’s normal approval mechanism and before the model is necessarily involved.
The researchers emphasized that Git itself is not being described as having a newly discovered flaw. core.fsmonitor is an intended Git feature designed to speed up operations on repositories containing large numbers of files.
The security problem comes from allowing untrusted repository configuration to control an automatically executed Git process before the AI agent’s own security controls are applied.
The delivery method also has an important limitation. Git does not normally transfer the local .git/config file when a user clones, fetches or pulls from a remote repository. Manifold said its proof-of-concept repositories were instead delivered as files containing the existing .git directory, such as through ZIP archives, shared drives, synchronized folders or removable media.
For Claude Code, Manifold identified two separate findings. The first involved core.fsmonitor. The researchers said Claude Code ran git status during repository-context gathering at startup, before the workspace-trust prompt was accepted.
The issue was confirmed on Claude Code 2.1.193 and reported on June 26, 2026. Manifold said it was closed as a duplicate of a report filed earlier that day and was fixed in version 2.1.196.
The second Claude Code finding involved the ultrareview workflow and a different Git configuration setting capable of executing a command. Manifold deliberately did not identify that setting while the issue remained unpatched.
The ultrareview finding was reported July 15, 2026, on version 2.1.210. Manifold said it was closed as a duplicate of an internal ticket but remained unpatched when researchers confirmed it again on version 2.1.252 on September 1.
Goose was also affected. Manifold found that goose review used Git to collect the changes being reviewed without removing attacker-controlled Git configuration.
According to the project’s published security advisory, the review command can invoke git diff HEAD during context collection. A malicious core.fsmonitor setting can then cause Git to execute the configured command during the index refresh.
The Goose issue affected version 1.41.0 at the time of testing and was reported July 13. It was fixed in version 1.44.0 and assigned CVE-2026-72718, with a CVSS 4.0 score of 7.0, classified as high severity.
The Goose advisory says the command can execute with the privileges of the user running Goose and inherit the user’s environment, potentially exposing environment secrets and provider API keys.
Manifold found a similar issue in Hermes Agent. The agent runs git status while gathering repository context and, according to the researchers, passes the repository’s Git configuration through unchanged.
The issue was confirmed on Hermes 0.18.2 on July 19 and reported the following day. Manifold said it made six contact attempts through five channels without the private security advisory being triaged.
The researchers assigned the issue CVE-2026-71963 through VulnCheck, which Manifold described as an independent CVE Numbering Authority. The issue was confirmed again on Hermes 0.21.0 on September 1 and remained unpatched.
Qwen Code was another affected product. Manifold said Qwen Code runs git status at startup to gather repository context and leaves the repository’s configuration available to Git.
The researchers said the payload could execute when a user opened a folder with Qwen Code, before authentication had taken place. The finding was confirmed on version 0.19.6 and reported to Alibaba’s security response centre on July 7, where it was accepted.
Manifold re-tested the issue on Qwen Code 0.22.3 on September 1 and reported that it remained unpatched.
A separate Qwen Code security issue also describes the underlying problem: commands treated as read-only can execute programs configured outside the command text through repository Git settings such as diff.external and core.fsmonitor.
Grok Build showed another variation of the same problem. Manifold said the agent runs Git to gather repository context and leaves the repository configuration available to that process.
In its test, opening a repository with Grok Build and beginning to type a prompt was enough to trigger the payload on the first keystroke, before the message was sent.
The finding was confirmed on Grok Build 0.2.93. Manifold said an earlier report of the same class had been filed July 1 and closed as informative. Its report followed on July 14 and was closed as a duplicate of the earlier report.
Manifold confirmed the issue again on version 1.0.13 on September 1 and said it remained unpatched.
Across the six findings, Manifold’s disclosure timeline shows Claude Code’s core.fsmonitor issue reported June 26 and patched in 2.1.196; Qwen Code reported July 7 and still unpatched in 0.22.3; Goose reported July 13 and patched in 1.44.0; Grok Build reported July 14 and still unpatched in 1.0.13; Claude Code’s ultrareview issue reported July 15 and still unpatched in 2.1.252; and Hermes reported July 20 and still unpatched in 0.21.0.
Manifold said every finding was reported privately. The company also said every finding that remained unpatched was re-confirmed against a current release before publication. It found the same type of flaw in additional agents that it did not name.
The researchers said the issue is not limited to core.fsmonitor. Git contains other configuration mechanisms that can cause external programs to run, which means disabling one setting may not address every execution path.
For developers using affected tools, Manifold recommends inspecting .git/config before opening an unfamiliar repository with an AI coding agent. For developers building such agents, it recommends sanitizing Git configuration during automatic context gathering. One example given by the researchers is running git -c core.fsmonitor=false status.
The research also highlights a distinction between the command an agent appears to execute and what Git can actually do after reading repository configuration. A command such as git status or git diff may be treated as read-only by an agent’s permission system while still causing Git to invoke an externally configured program.
That issue has also appeared in Qwen Code’s own public tracking. The project’s security discussion notes that command-text analysis cannot detect execution caused by settings stored in .git/config, and identifies additional configuration areas that require review.
Manifold said the five projects covered in its report collectively represent a large user base. It cited more than 77 million monthly npm downloads for Claude Code and GitHub star counts of more than 237,000 for Hermes, 143,000 for Claude Code, 54,000 for Goose, 27,000 for Qwen Code and 26,000 for Grok Build at the time of publication.
The research raises a broader security concern around background operations performed by AI coding tools. In the affected cases, the security-sensitive action takes place in the software surrounding the model rather than through an instruction generated by the model itself.
Discover more from Aree Blog
Subscribe now to keep reading and get access to the full archive.
