Security firm Manifold has disclosed an attack vector that abuses manipulated git repositories. Malicious commands placed in a repository's git configuration are executed automatically by terminal-based AI coding agents. The commands run with the developer's full privileges, outside the sandbox, without authentication and before any trust approval. Developers become victims simply by opening such a repository.

git -c core.fsmonitor=false status

Console agents typically run git queries in the background as soon as a repository is opened, to refresh their context. Claude Code and Qwen Code issue git status, Goose runs git diff. These calls use the complete local git configuration and happen before the trust prompt. When git refreshes its index, larger repositories can delegate that work to an external command via fsmonitor = <command> in the config. The command can be arbitrary.

Cloning is not a danger. The malicious configuration cannot reach a machine through clone, pull or fetch, so foreign repositories are safe according to Manifold. The risk lies in repositories copied locally, for example a zip file received from a colleague.

Manifold contacted the vendors before publication. Several have not yet patched, including Qwen and Grok. Anthropic fixed the fsmonitor gap, but a similar issue involving claude ultraview remains open. GPT does not appear in the report; Manifold only stated it found the pattern in more agents than named. In a later response to heise, Manifold said the full list of affected agents is still in the disclosure phase and includes both major AI labs and large software companies. Codex and Cursor were added to the list and are already patched.

Protection: anyone receiving a repository as a file should inspect .git/config for foreign commands. Any entry naming a program is suspicious. Agent vendors should sanitize their automatic git calls, for example with git -c core.fsmonitor=false status.