Git has a performance setting called `core.fsmonitor`. Its value is a command. Git runs that command to find out which files have changed, and it does so whenever the index is refreshed — which includes `git status` and `git diff`, two of the most ordinary operations there are.
Git reads the setting from the repository's own `.git/config`.
Put those three facts together and a cloned repository is a program that runs when you look at it. Researchers report that this executes attacker code inside Claude Code, Codex, Cursor, Grok and other coding agents. On some of them, the payload fires before the workspace-trust prompt has been accepted.
The safety question is asked too late
That last detail is the one worth sitting with, because it is a design failure rather than a bug.
Every serious coding agent has a trust gate: you open an unfamiliar directory, and the tool asks whether you trust this workspace before it will act in it. The entire security model of "just clone it and have a look" rests on that prompt.
If the payload runs before the prompt is answered, the prompt is not a gate. It is a notification issued after the event, and the user's answer has no bearing on what has already happened.
Why the sandbox did not catch it
Because the sandbox was designed around the wrong threat.
The mental model for agent safety has been that the model might generate something harmful — a destructive shell command, an unwanted network call — and that the job of the harness is to sit between the model's output and the machine, allowlisting what may run. That is a sensible model and a great deal of careful work has gone into it.
It has almost nothing to say about this. No model generated anything. The agent ran `git status`, which is on every allowlist there is, for excellent reasons. The execution came from data the repository supplied, through a mechanism Git documents and implements on purpose.
That is the same shape this desk has described twice before. Installing a package runs its code, and that is the design rather than the attack. And a flaw in the artifact repository showed that everybody audits the package and nobody audits the shelf it sits on. Each time, the system did what it was specified to do and the specification contained the hazard.
The allowlist problem, precisely
Pillar Security's July work makes the general version of the point. In Codex CLI, the allowlist trusted `git show` by name — while the actual invocation was not read-only. OpenAI fixed it and paid a high-severity bounty, which is the right response.
But the lesson generalises badly for everybody shipping one of these tools. An allowlist keyed to a command name assumes the name determines the behaviour. For most Unix tools that is false, because behaviour is determined by the name plus the arguments plus the configuration plus the environment. `git` in particular is less a command than an execution framework with a config file.
A list of trusted binaries is therefore not a security boundary. It is a convenience that looks like one, and it will keep producing findings of this kind for as long as it is treated as the control.
What developers should actually do this week
Update. All the vendors named have shipped fixes and the specific findings are addressed.
Then change one habit, because the fixes address instances rather than the class. Cloning an untrusted repository is not a read-only act, and it has not been for years — this has been true of package installation for as long as package managers have run install scripts. Treat an unfamiliar repository the way you would treat an unfamiliar executable, which in practice means opening it somewhere that does not matter: a container, a VM, a machine without your credentials on it.
That is unglamorous advice and it is the only part of this that does not depend on a vendor.
What to watch
Not the next CVE in this family, which will arrive.
Watch whether any agent vendor moves the trust decision before the first filesystem read rather than before the first model action. That is the architectural fix — establish trust, then touch the directory — and it is considerably harder than patching a hook config, because it means the tool cannot show you anything about a repository until you have decided about a repository you cannot yet see.
Whoever solves that tension properly will have built the first coding agent whose safety prompt means what users already assume it means.
The description of Git's core.fsmonitor setting holding a command executed on index refresh, including by git status and git diff, and read from the repository's own .git/config; the reporting that malicious .git configurations can consequently execute attacker code in Claude Code, Codex, Cursor, Grok and other coding agents, and that on some the payload fires before the workspace-trust prompt is accepted; Pillar Security's July 2026 "Week of Sandbox Escapes" findings against Cursor, OpenAI's Codex CLI, Google's Gemini CLI and Google's Antigravity; the Cursor workspace-controlled hook configuration tagged CVE-2026-48124 and patched in version 3.0.0; and the Codex CLI allowlist that trusted "git show" by name with a fix shipped in v0.95.0 and a high-severity bounty paid are as reported by The Hacker News, Manifold Security, BleepingComputer, Techzine and the Cloud Security Alliance during July and September 2026. Vendors have shipped fixes and readers should update. This publication has not independently reproduced the findings. The analysis is our own.
Topics technologysecurity
