Brief · Both
You opened a folder. Windows ran the repo's git.exe.
On Oct 13 Anthropic published an advisory for Claude Desktop on Windows: CVE-2026-88066, rated High, CVSS 4.0 score 7.5. Versions before 1.8089.0 are affected, and 1.8089.0 is the fix.
The bug is old. Claude Desktop launched git.exe "without specifying an absolute path, causing the process to search the current working directory (CWD) before system directories." Put a git.exe in a repo, get someone to open that folder, and yours runs. Per Anthropic, it ran "without any explicit user interaction beyond opening the project." Their advisory calls it remote code execution "exploitable through supply chain vectors such as cloned repositories."
No jailbreak. No clever prompt. The AI part of the AI app wasn't involved. It's a Windows search-path bug, CWE-427, and we've been writing these up since before most agents' developers could drive.
It's also a repeat. In July, Cursor for Windows 3.2.16 got CVE-2026-63093 for the same trick: a git.exe in the repo root that Cursor "automatically resolves and executes" when the workspace opens. Cursor's fix makes it spawn Git "by a validated absolute path," in 3.13.25 or later.
Two major desktop agents, one bug, three months apart. My take: these tools still treat the project folder as trusted, the way Windows apps did in 2010. A cloned repo is untrusted input. Code it ships should never get run just because you opened the folder.
Do these people know you can just type the full path?
What to do:
- Update. Claude Desktop 1.8089.0 or later. Anthropic says standard auto-update has already shipped the fix, so this mainly applies to manual installs and machines where policy blocks updates. Cursor: 3.13.25 or later.
- Until you're patched, don't open untrusted repos in Claude Desktop on Windows.
- Hunt. Look for a git.exe or any other .exe committed at the root of repos people have cloned. Unless you meant to vendor a binary, a committed executable is a finding.
- Builders: spawn helpers by absolute path, or resolve them yourself and refuse anything inside the working directory or its parents. On Windows, never let a bare name resolve against the CWD.
- CISOs: treat desktop agents like any other app that executes code from opened files. Track their versions, make sure auto-update actually runs, and use application control to block executables launched from user-writable project folders.
Sources
- Anthropic: GHSA-4p2j-qj3c-6x84, Uncontrolled Search Path Enables Arbitrary Code Execution via Malicious Git Executable (Oct 13, 2026)
- CVE-2026-63093 (Cursor) on cve.org
- GitHub Advisory Database: GHSA-prfr-jc65-hr23 (Cursor, Jul 17, 2026)
- Cursor forum: Addressing the recent Mindgard report (incl. Aug 2026 fix update)