Recent findings by Manifold Security have revealed eight security vulnerabilities across seven command-line AI coding agents, including Claude, Codex, and Cursor. These vulnerabilities arise from the agents executing commands specified in a repository’s Git configuration, which can run on a developer’s machine without user approval.
Details of the Vulnerabilities
The vulnerabilities allow commands to be executed as the user, outside the agent’s sandbox. For exploitation to occur, the repository must be delivered with its .git directory intact, a condition met through shared archives, drives, sync folders, or USB sticks, but not through a standard clone. As of the latest updates, fixes have been released for goose, Claude Code, and Cursor, while Hermes Agent, Qwen Code, Grok Build, and another path in Claude Code remain unpatched.
Specific Affected Versions
Manifold’s report identifies the following affected versions:
- goose: All versions prior to 1.44.0, fixed in 1.44.0
- Codex CLI: 0.102.0 through 0.130.0, fixed in 0.131.0
- Codex Desktop for macOS: 260202.0859 through 26.513.31313, fixed in 26.519.22136
- Codex Desktop for Windows: 26.304.38 through 26.513.40821, fixed in 26.519.21041
- Claude Code: Confirmed on 2.1.193, fixed by 2.1.196
- Hermes Agent: 0.18.2 and 0.21.0 confirmed, fix pending
- Qwen Code: 0.19.6 and 0.22.3 confirmed, fix pending
- Grok Build: 0.2.93 and 1.0.13 confirmed, fix pending
Implications of the Vulnerabilities
These vulnerabilities can allow attacker-controlled code to run with the user’s privileges, enabling access to files and resources on the user’s account. OpenAI has acknowledged similar vulnerabilities in Codex, specifically noting that the helper runs outside Codex’s command sandbox, allowing for potential exploitation.
Manifold’s analysis indicates that the vulnerabilities are rooted in the underlying Git configuration rather than the AI models themselves. The core.fsmonitor setting in Git, which identifies changed files, is particularly implicated, as it executes commands from the repository’s .git/config during various operations.
Current Status and Recommendations
While some vulnerabilities have been patched, several remain unaddressed. Users are advised to inspect their .git/config files for suspicious commands and consider disabling the core.fsmonitor setting by default to mitigate risks. As of now, there are no confirmed reports of exploitation of these vulnerabilities.
This article was produced by NeonPulse.today using human and AI-assisted editorial processes, based on publicly available information. Content may be edited for clarity and style.
