CVE-2026-19592Active Exploitation

Claude Code, Cursor, and Codex CVE-2026-19592 all got caught running attacker code before you ever see a trust prompt. Manifold Security found 8 of these flaws across 7 command-line coding agents: Claude Code, Cursor, Codex, Goose, Hermes Agent, Qwen Code, Grok Build. Same root cause every time. The bug lives in core.fsmonitor, a Git perf setting that names a command Git runs to check which files changed. Git reads that value straight from the repo's own.git/config. Any index refresh triggers it: git status, git diff, the branch check your agent runs silently on startup. On Claude Code and Hermes Agent, the payload fires before the workspace-trust prompt even shows up. On Qwen Code, before you've authenticated. On Grok Build, on the first keystroke. No prompt to the model. No tool approval. Just opening the folder is enough. Exploitation needs the.git folder intact: a shared drive, a synced folder, a USB stick, a zip a contractor sent you. A normal git clone strips this. But how many repos do you actually clone vs just copy from a client's shared drive? goose got CVSS 7.0 (CVE-2026-72718), fixed in 1.44.0. Claude Code patched the core.fsmonitor path in 2.1.196, but a second path through claude ultrareview was still live on 2.1.252 as of Sep 1. Codex CLI fixed in 0.131.0, covered by CVE-2026-19592. Hermes Agent, Qwen Code, Grok Build: still unpatched at publication. BEFORE (dangerous): agent runs git status/diff at session start to figure out branch and changes, before any trust decision, blindly trusting whatever the repo's.git/config says to run. AFTER (safe): sandbox every git subprocess call, strip or validate repo-supplied config keys (core.fsmonitor, hooks) before the first invocation, gate ANY git command behind the workspace-trust decision, not just tool calls. Building agents that touch untrusted repos? Go check which git commands yours fires before the user approves anything. Would you even notice if your CLI agent ran a command before you saw a trust prompt? #AISecurity #PromptInjection #SupplyChainSecurity

玩了快一年的 Vibe Coding 和 Agentic IDE，今天终于迎来了全行业的“回旋镖”： 刚曝光的 GitSpawn 漏洞（CVE-2026-19592 等），几乎把目前市面上所有的 AI 编程 Agent（Claude Code、Cursor、Codex、Qwen Code）穿了个底朝天。 它的攻击路径极其讽刺且优雅： 为了追求所谓的“零摩擦上下文加载”，AI Agent 连 Workspace Trust 弹窗都懒得打扰你，只要你把代码目录一打开，后台立刻自动触发 git status 和 git diff 去拉取项目状态。 攻击者只需要在恶意 repo 的 .git/config 里面塞一行 core.fsmonitor 配置。 Git 跑状态检查时会把它当成合法的本地辅助进程拉起——没有沙箱隔离，不弹审批确认，直接以当前系统用户的全权限执行 Shell 脚本。 你的本地环境变量、.env 里的 API Key、~/.ssh 私钥，瞬间被掏得干干净净。 过去两年，所有 AI 工具都在拼命宣传“全自动”、“免确认”、“给 Agent 终端权限”。为了给用户营造“动动嘴代码就写好”的爽感，把操作系统花了二十年建立的信任边界（Trust Boundary）当成了阻碍转化的摩擦力。 当便利性彻底凌驾于安全之上，你以为你在让 AI 帮你打工，其实是你把本地最高权限直接挂到了公网裸奔。 建议今天所有在用 AI 编程助手的同行，赶紧去把各自的 CLI 和 IDE 升到最新修补版，来历不明的 zip 源码包千万别顺手直接扔进 AI 编辑器里跑。

AI每天跟我说：这周只盯一件事——你把文件夹丢给 coding agent 的时候，它默默信了哪些东西。 不是又在说 GitSpawn，那只是其中一个证据。Manifold 披露之后，恶意 git config / fsmonitor（含 Codex 的 CVE-2026-19592）能让 agent 跑任意代码，这些陆续都有人写了。但你往后退一步看，问题不在某一个洞，而是整条本地工具链——hooks、MCP server、shell 环境、浏览器工具——agent 默认全信。 你自己写代码的时候，clone 一个陌生 repo 你心里有数，不会随便跑里面的脚本。但 agent 不想这些，它拿到权限就干活，.git 里藏什么它不挑的。 几家厂商修了 fsmonitor 那条路径之后，公开 writeups 里复测还点到 Hermes、Qwen、Grok Build、Claude ultrareview 等入口仍敞着。修一个洞容易，难的是有人系统地想过：这个 agent 的默认信任边界到底画在哪。 所以这周我自己的 checklist 就一条：每次把本地目录交给 agent 之前，先想清楚这个目录里有没有它会自动执行的东西。不用恐慌，但得养成习惯。

⚠️ HIGH — CVE-2026-19592 OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS automatically collected Git repo… ⚡ Exploit in the wild Full analysis → https://sec.kaitan.id/cves/CVE-2026-19592 #OpenAI #CyberSecurity #InfoSec