Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code

What happened

Manifold Security disclosed eight security vulnerabilities across seven popular command-line AI coding agents including Claude, Codex, and Cursor. These flaws let a malicious Git repository configure commands that the AI agents will run automatically on a developer’s machine. The commands execute with the user’s system privileges, bypassing sandbox restrictions and without any prompt for approval. At the time of disclosure, four of these vulnerabilities remain unpatched. Exploiting this requires the attacker’s malicious Git repository to be cloned or checked out by the developer.

The risk

This vulnerability turns trusted repositories into attack vectors by embedding harmful commands in their Git configurations. Developers expecting safe operation from AI coding assistants may inadvertently run arbitrary code, exposing their devices and networks to compromise. The fact these commands run outside the AI sandbox and with user-level permissions significantly raises the risk, since attackers can exploit any access granted to the developer’s machine. The attack depends on repository checkout, so the risk primarily targets developers who work with untrusted or modified repositories or use automation that does unchecked cloning.

Why it matters

Command-line AI coding agents are becoming integrated into development workflows, promising speed and automation. These newly revealed security flaws expose a critical blind spot in their design—a lack of controls on commands originating from Git configuration files. This forces teams to reconsider how they vet repositories before use and may slow adoption of AI automation until trust mechanisms improve. The risk raises operational costs for security controls and increases the attack surface for organizations relying on AI tools in development. For founders and operators, it means elevated caution around AI agents in build pipelines.

Who should pay attention

Developers and DevOps teams using AI-powered coding tools are the front line for this risk. Security teams need to reassess repository scanning and sandboxing policies. AI tool vendors must prioritize patches and rethink safeguards on command execution from repository metadata. Investors and buyers should factor this risk into evaluations of AI coding assistant offerings, as vulnerabilities like these can impact trust and market adoption.

What to watch next

Tracking patch availability for all affected agents is crucial. Watch for vendor announcements on improved safeguards that block unauthorized command execution from Git configurations. Also monitor industry response on security standards for AI coding tools and repository management. Longer term, expect pressure on AI agent developers to restrict system-level operations or require explicit user validation before running any repository-sourced commands.

AI Quick Briefs Editorial Desk