Malicious .git configs make Claude Code, Codex, Cursor run attacker code pre-trust-prompt
Thionne_WTZ · x · 2026-09-03
Manifold Security has disclosed 8 flaws across 7 CLI AI coding agents where a repo's own .git/config (e.g. core.fsmonitor) names a command the agent executes with user privileges — outside the sandbox and with no approval prompt.
Key facts:
- Exploitation requires the repo to arrive as files with .git intact (archives, shared drives, sync folders, USB); a normal clone is safe
- On Claude Code and Hermes Agent the payload fires before the workspace-trust prompt; on Qwen Code before auth, on Grok Build at the first keystroke
- Patched: goose, Claude Code, Cursor. Still unpatched at publication: Hermes Agent, Qwen Code, Grok Build, and a second Claude Code path
- OpenAI shipped three CVEs the same day for the identical class in Codex
More from coding & agent
- LLM one-shots a Minecraft 3x3 piston door by building its own Linux test infra — Vjeux · 2026-10-18
- Dev builds Mumbai-inspired 3D manga background generator from OpenStreetMap data — CurieuxExplorer · 2026-10-18
- Solo founder builds a money-printing data service on Claude's Pi Durable harness — MicahBerkley · 2026-10-18
- Dev builds Arch-based OS with custom desktop and browser using Claude Code — Snoo-10493 · 2026-10-18
- Five SaaS agent workflows fail the same way — and it's never model intelligence — usehive · 2026-10-18
- Claude skill generates hand-drawn interactive diagrams that teach kids how things work — CatAstro_Piyush · 2026-10-18