7 AI coding agents just got hijacked through a Git config file. 4 are still unpatched.

Your developers' AI coding agents have a new attack surface. And it's not the model.

Manifold Security disclosed 8 vulnerabilities across 7 AI coding agents on September 2.

Claude Code, OpenAI Codex, Cursor, Goose, Qwen Code, Grok Build, and Hermes Agent.

The attack vector is a single line in a Git config file. core.fsmonitor. A legitimate performance setting that Git reads from the repository's own .git/config.

When an AI coding agent opens a poisoned repository, it runs git status or git diff to understand the project. Those commands execute the attacker's payload automatically.

Outside the sandbox. No approval prompt. No trust dialog.

On Claude Code and Hermes Agent, the payload fires before the workspace-trust prompt is accepted. On Qwen Code, before the user has authenticated. On Grok Build, on the first keystroke.

OpenAI published 3 CVEs for Codex the same day. CVE-2026-19592 confirms the helper runs outside Codex's command sandbox with the user's full privileges.

As of September 1, four agents remained unpatched. Hermes Agent, Qwen Code, Grok Build, and a second Claude Code path. Hermes Agent's vendor left the private advisory untriaged after six contact attempts across five channels.

This is a supply chain attack. A zip file, a shared drive, a USB stick. Any delivery that preserves the .git directory works. A regular git clone does not.

Audit your AI coding agent versions today. Run git config --get core.fsmonitor in every repository that arrived as files. Set git config --global core.fsmonitor false. Strip the config on every background Git call.

The vulnerability is not in the model. It is in the plumbing underneath. And your security team was never built to monitor it.

SOURCE: https://thehackernews.com/2026/09/malicious-git-configs-can-make-claude.html
VERIFIED: The Hacker News (Sep 2, 2026), Cloud Security Alliance Research Note (Sep 4, 2026), Manifold Security GitSpawn Disclosure (Sep 2026)
SIGNAL: This exposes a blind spot in enterprise AI security. Every developer toolchain running Claude Code, Codex, or Cursor is exposed. Four vendors still have not shipped fixes. Your SOC was built to monitor network traffic, not Git subprocess calls.