AI Agents Vulnerable to Malicious .git Configs

Eight security flaws have been found in seven command-line AI coding agents. These flaws allow a repository's Git configuration to run attacker code on a developer's machine. Here's the thing: this code executes outside the agent's security sandbox and without requiring user approval. Exploitation happens when a repository arrives with its .git directory intact, such as from a shared archive or USB stick. Fixes have been released for agents like goose, Claude Code, and Cursor. However, Hermes Agent, Qwen Code, and Grok Build, along with a second path in Claude Code, were still vulnerable when retested on September 1st. OpenAI also published three CVEs for similar issues in Codex. The problem lies in how these agents use Git's `core.fsmonitor` setting. This setting allows Git to run a command to identify changed files. The agents unknowingly execute these commands in the background. The bottom line is that these vulnerabilities allow attacker-controlled code to run with a user's full privileges, potentially reading, changing, or deleting files.