core.fsmonitor is a Git performance setting whose value is a command. Git reads it out of the repository's own .git/config and executes it on any operation that refreshes the index, including git status and git diff [9]. Coding agents run exactly those commands in the background at session startup to work out which branch they are on and which files changed, and they leave the repository's configuration in place while doing it [10]. Manifold puts the fault in that subprocess rather than in the model, calling it the ordinary plumbing underneath [12].
Timing is what defeats the controls in each case. On Claude Code and Hermes Agent the payload fires before the workspace-trust prompt is accepted, on Qwen Code before the user has authenticated, and on Grok Build on the first keystroke [8]. OpenAI's record for CVE-2026-19592 describes the result plainly: the helper runs outside the command sandbox and without an approval prompt, and the attacker code can read, change, or delete the user's files and reach other resources the account can reach [7].
In goose, few protections stand between the repository and execution. The goose review command builds its Git invocations with one configuration flag, -c core.quotePath=off, and strips nothing else [16]. GitHub's advisory, which credits Francisco Rosales, says running goose review in a malicious repository runs attacker code with no submitted prompt, no model call, no tool approval and no trust prompt, before goose ever contacts the model [18]. That advisory carries a CVSS 4.0 base score of 7.0, the only score attached to any of these findings [17].
Anthropic already closed this once. Sonar reported the same sink in April and noted that Claude Code 2.0.34 had stopped running git status before the trust dialog was approved, while a related issue persisted [19][20]. Version 2.0.34 shipped November 5, 2025; Manifold found the same startup behavior in 2.1.193, which shipped June 25, 2026 [21]. That is 232 days between the mitigation and the recurrence [1]. Anthropic's June advisory for CVE-2026-55607 had already named git fsmonitor execution during worktree operations [22].
Five of Manifold's eight reports came back as duplicates of findings other researchers had filed independently, one of them on the same day [23]. That is 62.5 percent of the set [2]. OpenAI's three Codex CVEs were credited to three unrelated research groups [6], and Manifold says the pattern is present in more agents than it names [11]. Multiple parties are pulling on the same thread at once, which shortens the window before working code circulates.
What limits this is delivery. The repository has to arrive as files with .git intact, which a shared archive, a shared drive, a sync folder or a USB stick preserves and an ordinary clone does not [3]. Cloning a hostile repository from a remote is not the vector here; the customer-supplied zip and the synced directory are. Current floors are goose 1.44.0 and Codex CLI 0.131.0 [13][14], with Claude Code fixed at 2.1.196 on the core.fsmonitor path and the claude ultrareview path confirmed live on 2.1.252 [15].
