AI agents automatically execute git malware when starting

The security firm Manifold has discovered an attack vector through manipulated git repositories. These contain commands in the configuration that are automatically executed by AI agents in the terminal – with the developer’s full rights, outside the sandbox, without requiring authentication, and without a prior trust prompt. Developers fall victim as soon as they open such a repository.

When opening a repository, AI agents on the console often immediately perform a series of git queries in the background to update their context, such as git status for Claude Code and Qwen Code, or git diff for Goose. These queries are executed with the complete local git configuration, outside the sandbox, and before any trust approval. Git then updates its index, which can be configured in larger repositories to delegate to an external function: fsmonitor = . The command to be executed can be arbitrary.

The prerequisite for the attack is that the malicious git configuration, which uses a harmful , reaches the user’s computer. This cannot happen through clone, pull, or fetch; according to Manifold, foreign repositories are not a danger. More problematic are repositories that you receive from colleagues as a zipfile, for example, and copy into your system.

Manifold contacted the manufacturers before the release, but a number of them have not yet patched the vulnerability, for example Qwen or Grok. Anthropic has fixed the fsmonitor vulnerability, but not a similar one with claude ultraview . GPT is not mentioned in the report; it only states “We found it in more agents than we name here.” heise developer/iX has inquired with Manifold this.

If you receive a repository as a file, you should check the .git/config file for foreign commands. Any entry that names a program is suspicious. If you offer an agent, according to the blog post , you should clean up automatic git commands, for example with git -c core.fsmonitor=false status .

Mainfold has now responded to our inquiry. The full list of affected agents is still in the disclosure phase, during which manufacturers have time to fix the vulnerability once it has been reported. “What we can say is that the pattern isn't limited to the agents named, and the affected vendors include both major AI labs and large enterprise software companies.” Codex and Cursor have since been added to the list, but have been patched.

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.