Git config can execute before agent approval

Security researchers at Manifold found that five CLI AI agents can execute a command supplied through a repository's Git configuration before displaying an approval prompt, exposing Claude Code, Goose, Grok Build, Hermes, and Qwen Code when they inspect a project.

At a glance

• Git commonly refreshes its index before context checks such as status and diff, and that refresh can invoke a helper specified by the repository through the core.fsmonitor configuration setting.
• Cloning, fetching, and pulling do not carry the configuration, but a project distributed with its existing .git directory, including in a .zip archive, can retain it.
• Because the agent launches Git as its own subprocess, the configured command runs on the host with the user's privileges, outside the sandbox and before the approval system sees it.

Routine repository inspection is normally treated as low-risk plumbing, which makes this execution path especially awkward for tools that begin work by gathering context. The finding appears to shift the security boundary from the agent's visible command approvals to a lower-level configuration file already present on disk. In practice, a project passed around as an archive may carry code whose execution is not represented as an agent action at all.

Git status and git diff can refresh the index before returning results

The agents examined by Manifold use Git to establish facts about the project that has just been opened. They may seek the current branch, modified or staged files, paths affected by a change, every tracked path, or a separate worktree for a sub-agent. These calls can occur at startup or after a session begins. The report gives `git status --porcelain=2 --branch` and `git diff --name-only HEAD` as examples.

Both commands touch the working tree, so Git refreshes its index before producing a result. The researchers describe that refresh as the execution sink: Git may run a file-monitoring helper while doing it, regardless of whether the agent selected status or diff. The refresh is a normal preparatory step, not a separate command requested by the agent.

core.fsmonitor lets a repository name the helper Git runs

core.fsmonitor is a Git performance setting intended for large repositories. Rather than checking every file on disk, Git can ask a helper program what has changed during an index refresh. The setting is read from the repository's own `.git/config`, where a repository can define a command for Git to run.

That makes the configuration consequential in an agent session. A repository can include `[core] fsmonitor = <command>`, and Git will execute the named command during a qualifying refresh; Git documents this as intended behavior. Manifold notes that core.fsmonitor is only one such configuration sink, and one of its findings uses a different Git setting.

Only repositories delivered with their .git directory trigger this route

Git does not transport this configuration when a project is cloned from a hostile URL, fetched, or pulled. For the setting to be present, the repository must arrive as files with its `.git` directory already inside. The report identifies directory-moving routes including shared archives, shared drives, sync folders, and USB storage, which colleagues and consultants may use to pass projects along.

Every proof of concept used a .zip archive containing that directory. Once an agent launches Git, the configured command runs on the host with the user's privileges, outside the agent sandbox and before approval. Because it is the agent's own subprocess, the approval model does not see the execution at the outset of a session.

The scope beyond five tools Manifold says it found the pattern in more agents than the five named in the report, but does not identify those additional products. The post also frames core.fsmonitor as one example rather than a complete list of Git configuration execution sinks. Its examples therefore establish a delivery condition and a mechanism, while leaving the full affected-product inventory unspecified.