The repo someone sent you can run code before you read it
If your team uses a command-line coding agent, there is a habit worth breaking this week: being handed a project as a zip file or a folder on a shared drive, and pointing the agent at it to find out what it does.
The agent will find out what it does. So will you, shortly afterwards.
What was disclosed
Manifold Security has published eight flaws across seven command-line AI coding agents, reported by The Hacker News on 2 September. In each, a repository's own Git configuration names a command, and the agent runs it on the developer's machine. The command executes as the user, outside the agent's sandbox, with no approval prompt.
The mechanism is a legitimate Git feature. core.fsmonitor is a performance setting whose value is a command Git runs to work out which files have changed, and Git reads it from the repository's own .git/config file. Any operation that refreshes the index, including git status and git diff, runs that command. Coding agents call exactly those commands at startup to establish which branch they are on and what has changed. Manifold put it well:
"The vulnerability is not in the model, or in anything new. It is in the ordinary plumbing underneath, the subprocess an agent spawns at session startup to work out where it is."
The timing is the sharp bit. On Claude Code and Hermes Agent, the payload fires before the workspace-trust prompt is accepted. On Qwen Code, before the user has even authenticated. On Grok Build, on the first keystroke. The safety prompt you would rely on arrives after the code has run.
OpenAI published three CVEs of its own the same day covering the same class in Codex. Its description of the impact is worth quoting because it is unusually direct:
"The helper runs outside Codex's command sandbox and without a user-approval prompt, allowing attacker-controlled code to run with the user's privileges. The code can read, change, or delete the user's files and access other resources available to the user's account."
The delivery method is the interesting part
Exploitation requires the repository to arrive as files with its .git directory intact. An ordinary git clone does not carry the attacker's config across, because Git builds a fresh one locally. That single fact is what makes this manageable, and it is also what tells you which habits are risky.
The .git directory survives when a repository arrives as a zip or tar archive, on a shared drive, through a sync folder like Dropbox or OneDrive, or on a USB stick. So the risky pattern is specific: a repo you received as files rather than cloned, opened with an agent. That covers a client sending you their codebase to review, a contractor handover, a "here's the project" archive in a support ticket, and a coding-challenge repository from a job applicant.
Where the fixes stand
Patched at disclosure: goose from 1.44.0, Codex CLI from 0.131.0 (with corresponding Desktop builds), Cursor CLI, and the core.fsmonitor path in Claude Code from 2.1.196.
Still open when Manifold retested on 1 September: Hermes Agent, Qwen Code, Grok Build, and a second path in Claude Code reached through a different Git configuration key that Manifold has withheld, confirmed live on 2.1.252.
Two details worth noting. This class has been closed before and reopened: Sonar reported the same sink in April, Claude Code 2.0.34 moved the startup sequence in November 2025 to avoid running git status before the trust dialog, and Manifold found the same startup behaviour back in 2.1.193. The same trust-dialog bypass has previously appeared in Visual Studio Code (CVE-2021-43891) and JetBrains IDEs (CVE-2022-24346), so this is a recurring pattern in developer tooling rather than a novelty in AI agents.
No source reports exploitation of any of these findings, and none appears in CISA's catalogue of vulnerabilities known to be exploited. This is a "close it before someone uses it" item, not a fire.
What to do
The checks are quick and the global setting is the one that keeps working after you forget about this.
- Update the agents your team uses. Codex CLI's current release is well past the fix, so an installation pinned below 0.131.0 is the thing to look for. Same for goose below 1.44.0 and Claude Code below 2.1.196.
- Turn the setting off globally.
git config --global core.fsmonitor falsedisables it by default. Almost nobody in a small team is relying on this for performance, and it removes the main path without needing to remember anything. - Audit what you already have.
git config --global --list | grep fsmonitorshows the global setting. Inside any repository that arrived as files rather than a clone,git config --get core.fsmonitorshows what that repo is asking for. - Inspect before opening. If a repository arrives as files, read
.git/configfirst, looking forcore.fsmonitor,core.hooksPath, andattr.treealongside any clean or smudge filter. This is a ten-second check. - Prefer cloning. Where you have the choice, clone from the source rather than accepting an archive. It removes the attacker's config entirely.
The wider habit this points at
The same week, a separate write-up noted that Claude Code stores MCP OAuth access tokens in plaintext JSON on Linux, in ~/.claude/.credentials.json with mode 0600, matching Anthropic's own documented behaviour (macOS uses the Keychain). File permissions are a real boundary, but "stored securely" reads to most people as encrypted, and on Linux it means protected by file permissions.
The two stories share a shape. Coding agents run with your privileges, on your machine, holding your credentials, and they inherit the assumptions of the tooling underneath them. When an agent is deciding what to execute, the trust boundary is wherever the plumbing puts it, not wherever the approval prompt appears. That is worth knowing before you grant the next agent access to a repository you did not write.
How Steelwise can help
Working out what your development tooling can reach, and where the trust boundaries actually sit, is the kind of review that is much cheaper before an incident than after one. Get in touch if you would like a second opinion on yours.