OpenAI Codex CLI and Codex Desktop automatically collect Git repository metadata without disabling the `core.fsmonitor` setting. If a user opens an attacker-prepared repository where the `.git/config` file specifies an attacker-controlled filesystem-monitor helper, Git may execute that helper during the metadata collection process. This execution occurs outside the command sandbox and without a user-approval prompt, allowing arbitrary code to run with the user's privileges. This can lead to the unauthorized reading, modification, or deletion of files and access to other account resources. Exploitation requires the repository to be delivered or copied with the `.git/config` file intact, as a standard Git clone does not preserve this local configuration. Real-world incidents of this issue being exploited have been reported.