Malicious .git configs can make Claude, Codex, Cursor AI agents run attacker code
jedisct1 · x · 2026-09-03
Manifold Security disclosed eight flaws across seven CLI AI coding agents where a repo's own Git config (e.g. core.fsmonitor) names a command the agent executes on the developer's machine—running as the user, outside the sandbox, with no approval prompt. Four flaws were unpatched at disclosure.
- Exploitation requires the repo to arrive as files with its .git directory intact (shared archive, sync folder, USB); a normal clone is safe
- Fixed: goose, Claude Code, Cursor. Still executing repo-supplied commands on retest: Hermes Agent, Qwen Code, Grok Build, and a second Claude Code path
- Payload fires before workspace-trust acceptance (Claude Code, Hermes), before auth (Qwen Code), or on first keystroke (Grok Build)
- OpenAI issued three CVEs for the same class in Codex, noting the helper can read, change, or delete user files
More from coding & agent
- Matt Pocock's pre-commit hook caps agent-written files at 5,000 tokens — mattpocockuk · 2026-10-18
- Author Laurence Moroney: write your ugly first draft yourself, then let an LLM edit it — lmoroney · 2026-10-18
- Open-weight TYGER speech decision model makes 80ms turn-taking calls for full-duplex voice agents — solyarisoftware · 2026-10-18
- Devs: Opus 5.5 on medium beats Opus on max — eyishazyer · 2026-10-18
- He Stopped Telling Claude Code to Stop Making Up Timestamps—and Made It Impossible with a PreToolUse Hook — Grimmoner · 2026-10-18
- Cursor Super + Claude Pro + OpenCode: can this stack survive heavy autonomous coding? — DarioAmodeiWasTaken · 2026-10-18