A repository's own git config can execute code the moment an AI coding agent opens it, because the agent's background git status call triggers core.fsmonitor before any prompt is typed. Seven agents shipped the same defect; several remained unpatched into September. The mechanism matters more than the CVE count: agent sandboxes gate model-initiated tool calls, not harness-initiated subprocesses.
Draft body lives in the Content JSON property.
Not by this vector. git clone, fetch and pull do not transfer the remote repository's .git/config to your machine, so the core.fsmonitor setting is never planted. Exposure requires the .git directory to arrive as files — a zip that includes it, a synced or shared folder, a USB drive, or a restored backup.
We cover the mechanics of AI tooling failures — permission models, patch ownership and the assumptions vendors ship by default.
Read more Technology analysisThe iPhone Duo costs $800 more than an iPhone 18 Pro and arrives five weeks later. Apple also pushed three other iPhones to spring 2027. Only one of those facts is about the hinge.
Microsoft's September release is the largest on record by any of the competing counts. Both of the flaws confirmed under active exploitation are rated Important, not Critical — which means a patch policy that triages on severity ships neither of the two vulnerabilities anyone is actually being attacked with.
CVE-2026-0768 is an unauthenticated root RCE in Langflow. It was disclosed in January, the fix has shipped through seven releases, and attackers are hitting it in September — because low-code AI middleware became critical infrastructure without acquiring a patch owner.