Claude Desktop could execute a repository-provided git.exe when opening a Windows project

The affected Windows startup path used uv_spawn for an unqualified git.exe command from a project working directory. A repository owner could place an executable named git.exe at that location so the desktop application would execute the repository copy while opening the project. A conventional user workflow of opening a trusted-looking repository therefore crossed from source code as data to executable code without a model needing to approve a malicious instruction.

Anthropic patched the path in version 1.8089.0. The advisory describes the file search order and exploit prerequisite but does not report observed exploitation across customer workstations. This is a client subprocess resolution flaw, not a model alignment failure.

The trusted boundary was crossed at project open, before the agent had to accept any hostile instruction. The application asked the operating system to launch git.exe, but did not bind that request to a trusted absolute executable identity. Because the opened repository could affect the search location, the path resolution supplied executable authority to untrusted project content. A useful regression test launches a repository with a harmless fake git.exe and verifies that opening it selects only the installed trusted Git binary on patched clients.