Eight AI Coding Agents Execute Attacker Commands via Malicious .git/config core.fsmonitor

Manifold Security identified the pattern in goose, Claude Code, Cursor, Codex CLI, Hermes Agent, Qwen Code, and Grok Build. The agents invoke git status or git diff at startup without sanitizing repository-supplied config values. core.fsmonitor executes the attacker's command as the user outside any sandbox and before trust prompts on multiple products. Exploitation requires an intact .git directory, preserved by USB, shared drives, or archives but not by standard clones. Four issues remained live on September 1 retests. OpenAI issued CVE-2026-19592 and two related records the same day for Codex paths matching the identical sink. Earlier Sonar reporting from April traced the same startup sequence flaw in Claude and linked it to prior IDE trust-bypass cases CVE-2021-43891 and CVE-2022-24346. The root cause sits in ordinary Git plumbing rather than model behavior or novel agent code. Agents that call Git to determine branch and changed files inherit the repository's config without isolation. This replicates supply-chain exposure previously seen in IDEs where local repository data was trusted implicitly. Fixes shipped for goose 1.44.0, Codex 0.131.0, and Cursor, yet remaining agents still process the config on first interaction or even pre-authentication. The pattern indicates that any tool spawning Git subprocesses on untrusted workspaces will repeat the exposure until explicit config stripping or sandboxed Git wrappers are applied across the board.