Claude Desktop on Windows Ran Whatever git.exe Sat in the Project Folder

Anthropic disclosed on October 13, 2026 that Claude Desktop for Windows could execute a malicious git.exe planted in a project directory, because the app spawned Git without an absolute path. The advisory is GHSA-4p2j-qj3c-6x84 under the anthropics/claude-code security namespace. The GitHub Security Advisory assigns CVE-2026-88066; the National Vulnerability Database had not yet published an entry for it at the time of writing. Severity is CVSS 4.0 7.5 High (AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H). Affected builds are Claude Desktop versions below 1.8089.0. The patched line is 1.8089.0. Anthropic says standard auto-update users already received the fix; manual updaters should move to the latest build.

The bug is classic uncontrolled search-path behavior (CWE-427), not a model jailbreak. Claude Desktop used uv_spawn to run git.exe and let the process search the current working directory before system directories. Opening a project whose folder contained an attacker-supplied executable named git.exe was enough for that binary to run. No further click inside a Git UI was required beyond opening the project. Anthropic credits Junhyuk Im, Jeongmin Choi and Seungyun Lee of S2W for the report.

Why a coding desktop made this worse than a CLI typo

Claude Desktop sits where repositories, credentials and agent tooling meet a graphical session. Developers open cloned projects all day. Supply-chain and shared-folder vectors already assume an adversary can place files in a tree you will open—compromised mirrors, zip drops, USB handoffs, or a teammate’s machine that still syncs an old directory. When the desktop agent resolves git.exe from that tree, the trust boundary is no longer “the Git installer I chose,” it is “whatever executable shares a name with Git in this folder.”

CVSS 4.0 marks attack requirements as Present and user interaction as Active: the victim must open the crafted project on Windows. Privileges required are None. Confidentiality, integrity and availability impacts on the vulnerable system are all High. Subsequent-system impacts are None on the vector Anthropic published. In plain terms, the compromise is local to the machine that opened the project, but that machine is exactly where coding agents hold tokens, SSH keys and repository access.

Fixed version and who still needs to move

The advisory’s remediation is short: update Claude Desktop to 1.8089.0 or later. Auto-update customers are described as already patched. Anyone on a pinned enterprise package, an air-gapped installer, or a skipped update prompt should verify the running version rather than assume the channel caught up. Until that check is done, treat untrusted repositories on Windows as higher risk for Claude Desktop sessions—open them only after the build number is confirmed.

There is no separate “enable a flag” mitigation called out on the advisory page. Absolute-path process spawning is the durable engineering fix; rotating credentials after a suspicious open is operational hygiene if a machine may have executed unknown code. Anthropic’s write-up does not claim macOS or Linux Desktop builds share this specific search-path defect; the package named in the advisory is Claude Desktop on Windows.

How this sits beside other agent-desktop risks

October’s agent security queue has been heavy on MCP SDK redirects, gateway SSRF and unbounded request bodies. This advisory is a different class: a desktop host resolving a developer tool by bare filename. It does not require an MCP server, a malicious prompt, or a model that cooperates. The agent product simply needed Git and asked the OS for git.exe the unsafe way.

That distinction matters for security reviews. Prompt-injection defenses and tool allowlists do not catch a process that never reaches the model. Desktop coding agents inherit every footgun of native app packaging—search paths, DLL planting, updater channels—on top of LLM-specific issues. A model that refuses a dangerous tool call is irrelevant if the host already ran attacker code while resolving a dependency binary.

Teams rolling out Claude Desktop beside corporate Git should inventory Windows endpoints for build 1.8089.0+, confirm auto-update is healthy, and keep project directories free of unexpected executables as baseline hygiene. Shared clone mirrors and “open folder” workflows deserve the same scrutiny applied to unsigned installers. If a machine may have opened an untrusted tree on an older build, rotate local credentials and review recent process telemetry rather than assuming the patched channel undoes prior execution.

The October 13 disclosure is already patched upstream. The remaining work is verification: check the version on every Windows machine that opens repositories through Claude Desktop, and treat any pre-1.8089.0 install as overdue rather than theoretical.