Affected Systems

Seven command-line AI coding agents: goose (fixed in 1.44.0), Codex CLI/Desktop (fixed in 0.131.0 / 26.519.x), Claude Code (partially fixed in 2.1.196, second path unpatched in 2.1.252+), Hermes Agent 0.18.2–0.21.0 (unpatched), Qwen Code 0.19.6–0.22.3 (unpatched), Grok Build 0.2.93–1.0.13 (unpatched), and Cursor (status unclear). Affects developers who open repositories with intact .git directories from shared archives, USB drives, or sync folders.

Exploitation Status

Actively exploitable. No public PoC published by Manifold Security, but technical details disclosed. OpenAI published three CVEs (CVE-2026-19592 and two others) for Codex on September 1, 2026. GitHub assigned CVE-2026-72718 (CVSS 4.0: 7.0 High) to goose. VulnCheck assigned CVE-2026-71963 to Hermes Agent. Four vulnerabilities remain unpatched as of September 1, 2026. Hermes Agent was used in a July 2026 intrusion against a Thai government network.

Business Impact

Developers using affected AI coding agents can have arbitrary code executed with their user privileges when opening a malicious repository containing a crafted .git/config file. Exploitation occurs outside the agent's sandbox, before workspace trust prompts, and without user approval. Attackers can read, modify, or delete files and access resources available to the developer's account. Risk is elevated for teams that share repositories via archives, USB drives, or cloud sync folders rather than standard Git clones (which do not preserve .git/config). Four agents remain vulnerable: Hermes Agent, Qwen Code, Grok Build, and a second execution path in Claude Code.

Urgency

🔴 Immediate

Recommended Actions

  • Update goose to 1.44.0 or later, Codex CLI to 0.131.0 or later, Codex Desktop to 26.519.22136 (macOS) or 26.519.21041 (Windows) or later, and Claude Code to 2.1.196 or later immediately
  • Discontinue use of Hermes Agent 0.21.0 and earlier, Qwen Code 0.22.3 and earlier, and Grok Build 1.0.13 and earlier until patches are released
  • Enforce policy that developers only clone repositories via standard Git commands (git clone) and never open repositories from archives, USB drives, or sync folders with intact .git directories
  • Audit developer workstations for use of affected AI coding agents and review recent repository sources; inspect .git/config files for suspicious core.fsmonitor or similar Git hook settings
  • Monitor vendor advisories for Anthropic Claude Code (npm package), Alibaba Qwen Code, Nous Research Hermes Agent, and xAI Grok Build for patch availability