News Date: 2026-09-02
A directory received through a shared archive, synchronization service or removable drive can become a code-execution trap when opened with certain AI development agents. Research from Manifold Security identified eight vulnerabilities across seven tools that trusted repository-controlled Git settings during automated background operations.
The Risk Hides Beneath the Model
The central problem is not the language model itself. It is the software plumbing used by coding agents to inspect branches, calculate file changes and understand a project before responding to the developer.
Git supports a configuration option called core.fsmonitor, which can point to a command that Git runs while refreshing repository information. If an attacker distributes a project with its .git directory intact, a malicious command can be stored in the repository configuration. An AI agent that automatically runs commands such as git status or git diff may then trigger the payload.
In some affected products, execution occurred outside the agent sandbox and without a user approval prompt. Researchers also found cases in which the command ran before the workspace trust dialog was accepted, before authentication or after the user's first keystroke.
Fixes have been released for goose, Codex, Cursor and part of the affected Claude Code behavior. However, some reported paths involving Claude Code, Hermes Agent, Qwen Code and Grok Build remained unresolved when the systems were retested on September 1.
Practical Defensive Measures
- Update every locally installed AI coding agent and avoid pinning older command-line versions.
- Inspect the .git/config file before opening projects received as complete directories or archives.
- Check for suspicious settings such as core.fsmonitor, core.hooksPath and unexpected filter commands.
- Reconstruct untrusted projects through a clean Git clone when possible, rather than opening transferred working directories.
- Run development agents inside isolated environments with limited credentials and file access.
Developer Convenience Expands the Trust Boundary
I believe this research exposes a structural weakness in modern development workflows. AI assistants are becoming orchestration layers that quietly call Git, shells, package managers and testing tools. Each automated action can inherit a legacy behavior that was designed before autonomous agents routinely operated across sensitive workstations.
In my view, workspace trust must be enforced before any background command runs, not merely before the model begins editing code. Vendors should also sanitize repository-specific configuration and clearly show every external process launched during initialization. An intelligent assistant should not make an untrusted project more powerful than it would be in a conventional development environment.