On September 1, the same day Anthropic put its safeguards in a benchmark table and OpenAI declared a model “Critical,” a security firm published a bug that runs attacker code on your machine when a coding agent opens a folder. The Hacker News post got three points and one comment.

Seven agents. No prompt, no sandbox, no model in the loop. Claude Code alone ships 77 million npm downloads a month. And the class of bug is four years old.

The Mechanism

Git has a performance setting, core.fsmonitor, whose value is a command. Git runs it whenever it refreshes the index, which means on every git status and git diff. Git reads the setting from the repository’s own .git/config. So a repository can ship the command.

Coding agents run git the moment they open a folder, to build the status line in their system prompt. Manifold Security’s GitSpawn post names the commands: git status --porcelain=2 --branch, git diff --name-only HEAD.

This is the agent’s own code spawning a subprocess to use git, so the command runs outside the sandbox, without an approval prompt. The permission model never sees it.

— Francisco Rosales, Manifold Security, September 1

The honest caveat comes first. “Cloning a hostile URL does nothing, and neither does fetch or pull.” A clone does not copy the source repository’s local config. The repository has to arrive as files with its .git directory intact: “a shared .zip, a shared drive, a sync folder, a USB stick.” Every proof of concept in the post used a zip. That narrows the vector to exactly the thing people hand to an agent: a client’s archive, a colleague’s folder, a download.

Fixed in 2021

None of this was discovered in 2026. Justin Steven published the fsmonitor abuse in March 2022, along with buried bare repositories, and listed the software that ran git on open: VS Code, JetBrains, Atom, Visual Studio, and every shell prompt that shows a branch name. VS Code’s fix was CVE-2021-43891, shipped in 1.63.1: no git operations until the workspace is trusted. JetBrains followed with CVE-2022-24345. Git itself added safe.bareRepository in 2.38.

Then the agents arrived and ran git on open again. The Claude Code timeline, from Sonar’s and Manifold’s posts:

  • April 30, 2026. Sonar publishes the fsmonitor bug in Claude Code: git status “happens before Claude Code’s security prompt.” Mitigated in 2.0.34 “by no longer running git status before the user approved the trust dialog,” fixed in 2.0.71.
  • June 26. Manifold reports the same key again. Closed “as duplicate of a same-day report.” Patched in 2.1.196.
  • July 15. Manifold reports a second path, through claude ultrareview, the paid cloud review. A different git key, “one the review path does not strip.” Runs “even before the workspace-trust prompt is shown or accepted.” Closed “as duplicate of internal ticket.” Confirmed still open on 2.1.252 on September 1. Manifold has not named the key.

Read the word “strip.” The fix is not VS Code’s fix. It does not gate git behind trust. It removes dangerous keys from git’s config at each call site, and every new feature that shells out to git is a new call site. The cloud review command was added in 2.1.111, after Sonar’s fix, and it did not inherit the stripping. OpenAI’s three CVEs on September 1 show the other end of the same problem: CVE-2026-19592 for core.fsmonitor, CVE-2026-19590 for core.hooksPath, CVE-2026-19593 for attr.tree with a clean filter. Three keys, three advisories. Git has more keys than that.

The Responses

Manifold reported to eight vendors between June 26 and July 20. Five reports came back as duplicates, which means other researchers had found the same holes on their own, one on the same day. What each vendor did:

  • OpenAI: three CVEs, Codex CLI fixed in 0.131.0, Desktop fixed. None of the three appears in the Codex repository’s own security advisories.
  • Goose: acknowledged, CVE-2026-72718, fixed in 1.44.0.
  • Cursor: closed as duplicate, patched. No advisory found.
  • Anthropic: both reports closed as duplicates. Fsmonitor path patched in 2.1.196, cloud-review path open. I read the changelog entries for 2.0.34, 2.1.196 and every version since. Not one line mentions git, fsmonitor, or the trust dialog. The only “Security:” bullet in 2.1.196 is about MCP servers.
  • Alibaba, Qwen Code: accepted by its security response centre. Unpatched at 0.22.3.
  • xAI, Grok Build: “closed as duplicate of a 1 July report xAI had closed as informative.” Unpatched at 1.0.13.
  • Hermes: “No triage after six contacts across five channels.” Unpatched at 0.21.0, CVE-2026-71963 assigned anyway.

“Informative” is the word to keep. It is what Anthropic told Johann Rehberger a week earlier about breaking Auto Mode: a convenience feature, not a security boundary. Now xAI has used it for code execution on folder open. Two vendors, one fortnight, one word for a bug report that says the product runs attacker code.

What I Could Check

I run Claude Code 2.1.259, so I tested the fsmonitor path myself. A fresh repository in a scratch directory, never trusted, with core.fsmonitor pointed at a script that appends a timestamp to a marker file. Then claude -p in that directory with a one-word prompt.

The marker stayed empty. The control worked: a plain git status in the same repository fired the script once, and -c core.fsmonitor=false did not. So on the current build the fsmonitor path is closed, at least in print mode. I did not test the cloud-review path, because it is a billed run and the key is unpublished. That is the path Manifold says is still open.

What this is not

It is not remote code execution. The attacker needs you to receive a folder with its .git directory intact and point an agent at it, and the payload runs with your privileges, not root. The affected versions are old on the two paths that were fixed, and auto-update covers most installs. And the model is not the problem here at all: this is plain subprocess code, the kind that was already wrong in an IDE five years ago. Which is the point. The safeguards debate of the last week was about what the model will refuse. This code never asks it.

What To Do

  • Update. Codex CLI 0.131.0 or later. Claude Code 2.1.196 or later closes the known path. Goose 1.44.0.
  • Inspect before you open. For any repository that arrived as files rather than a clone, run git config --local --list first and look for fsmonitor, hooksPath, attr.tree, or any filter. Or delete .git and re-clone from the source you trust.
  • Do not run the cloud review on an untrusted folder until Anthropic says the second path is closed. Nothing in the changelog will tell you.
  • If you build an agent: wrap every git call in one function, and make it VS Code’s function. No git before trust. Passing -c core.fsmonitor= at each call site is the fix that regressed in June and missed the review path in July.

The industry spent the same forty-eight hours announcing vetting programs for who may use its models. The folder was the exploit, and it needed no model at all.

Related Posts

Security Review Moved Into the Loop
[5 MIN]

Security Review Moved Into the Loop

Anthropic's new security-guidance plugin is built entirely on hooks. It fires on every edit, turn, and commit, hands the diff to a second Claude with fresh context, and fixes findings in the same session. It catches vulnerabilities before they reach the PR. It also doesn't block a single one, and that's the honest part.

securityclaude-codeai-coding