Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code
Summary
AI coding agents like Claude, Codex, and Cursor can be tricked into running malicious code when a developer clones a repository that contains a crafted Git configuration file (.git/config). The vulnerability works because these agents automatically run Git commands in the background to check file status, and the malicious configuration specifies a command (using a Git setting called core.fsmonitor) that executes with the developer's full permissions, bypassing any safety checks or approval prompts.
Solution / Mitigation
Updates have been released for some affected tools: goose (update to version 1.44.0 or later), Codex CLI (update to 0.131.0 or later), Codex Desktop for macOS (update to 26.519.22136 or later), Codex Desktop for Windows (update to 26.519.21041 or later), and Claude Code (update to 2.1.196 or later for the core.fsmonitor vulnerability). For Hermes Agent, Qwen Code, and Grok Build, fixes are pending.
Classification
Affected Vendors
Related Issues
CVE-2026-63086: text-generation-inference through 3.3.7 contains a server-side request forgery (SSRF) vulnerability in the OpenAI-compat
CVE-2026-34371: LibreChat is a ChatGPT clone with additional features. Prior to 0.8.4, LibreChat trusts the name field returned by the e
Original source: https://thehackernews.com/2026/09/malicious-git-configs-can-make-claude.html
First tracked: September 2, 2026 at 02:00 PM
Classified by LLM (prompt v3) · confidence: 92%