Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code

[XploitLK-Bot]

Manifold Security has disclosed eight security flaws across seven command-line AI coding agents, where a repository’s own Git configuration can trick the tool into executing an attacker-controlled command on the developer’s machine. The attack relies on malicious .git config files, which can name a command that the agent unknowingly runs outside its sandbox and without an approval prompt.

Four of the eight flaws remain unpatched at the time of publication. The affected agents include popular tools such as Claude, Codex, and Cursor, among others. The command executes with the privileges of the logged-in user, meaning a successful exploit could lead to credential theft, data exfiltration, or full local compromise.

Exploitation requires the repository to arrive on the target machine—via a cloned project, a pull request, or a compromised dependency—after which the embedded Git configuration triggers the agent into running the malicious command. The issue highlights a broader risk in AI-assisted development: the trust placed in repository metadata and the assumption that sandboxing is enforced consistently across agent implementations.

• Attack surface: malicious .git config files within a repository.
• Impact: command execution as the current user, bypassing sandbox and approval prompts.
• Status: four of the eight vulnerabilities are still unpatched.

Source: The Hacker News

Are your development teams vetting repositories before letting AI agents open them, or is that trust still assumed by default?