AI Coding Agents - Malicious .git/config Remote Code Execution
What Happened
On September 2, 2026, cybersecurity firm Manifold Security disclosed eight critical security vulnerabilities affecting seven major command-line AI coding assistants, including Anthropic's Claude Code, Cursor, goose, Hermes Agent, Qwen Code, Grok Build, and OpenAI's Codex (assigned CVE-2026-19592). The vulnerability allows an attacker to execute arbitrary code on a developer's local machine with their user privileges, completely bypassing the agent's sandbox and workspace-trust prompts.
The exploit targets the local Git configuration. When a developer opens a repository (via shared archive, USB, sync folder, or shared drive) that preserves the hidden `.git` directory, the AI coding agents automatically parse the `.git/config` file to optimize performance. Attackers can poison this configuration file by utilizing the `core.fsmonitor` parameter (a Git setting that names a system command Git runs to identify changed files). The moment the AI agent opens the directory or reads the repository, it blindly executes the command listed in `core.fsmonitor` on the host machine. The execution occurs outside the agent's sandbox, without any user approval prompt, and on some platforms (like Grok Build or Qwen Code), it triggers on the very first keystroke or even before the user has authenticated.
How MEG 1 would have acted
The agent's automatic execution of system commands supplied by an untrusted, local configuration file represents a severe failure of input validation and environment containment, failing the safety boundaries of the Index of Safety and Responsibility (ISR).
MEG 2 Analysis - Legal Framework
Agent level: N3 (individualized/advanced) - coding and development assistant agents operating with direct local terminal execution, file system modification, and repository read privileges.
Cause (6.1):
(a) system defect - design flaw in the agent's parsing architecture that allows untrusted local configuration files (like .git/config) to execute arbitrary shell commands on the host without sandboxing or workspace-trust validation (severe design defect), attributable to the manufacturers.
(c) illicit diversion of control (hijacking via Git configuration poisoning) - the external attacker manipulated the agent's local environment parser to execute unauthorized commands (hijacking).
Attachment of liability: The platform manufacturers are fully liable for the system defects (6.1a) that allowed configuration-based remote code execution; developers and operators share liability if they open unverified, raw directories containing intact .git files (9.4).
Procedural Mechanism
6.2 (architectural human confirmation): Running any shell command or executing local scripts must require strict, non-bypassable architectural human confirmation. Opening a directory or parsing its performance configurations must be technically blocked from executing any local binaries without explicit user consent.
9.4 (least privilege): Coding agents must be strictly sandboxed, and their local execution engines must be technically prevented from reading or acting on sensitive configurations (such as core.fsmonitor or .git/config) without platform-level security clearance, complying with the principle of least necessary access.
7.1 (independent forensics): All terminal commands, workspace parsing events, and tool executions initiated by the coding agents must be logged in a secure, unalterable independent ledger to detect configuration-based hijacking attempts before code is modified or credentials are stolen.