Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code

Manifold Security has disclosed eight security flaws across seven command-line AI coding agents in which a repository's own Git configuration names a command that the agent runs on the developer's machine, four of them still unpatched at publication. The command executes as the user, outside the agent's sandbox and without an approval prompt, and exploitation requires the repository to arrive

The article reports that Manifold Security disclosed eight security flaws in seven command-line AI coding agents where a repository’s own .git configuration can define a command that the agent automatically runs on the developer’s machine, with four issues still unpatched at publication. The command executes with the user’s privileges, outside the agent’s sandbox and without an approval prompt, and exploitation requires a developer to work with a repository containing a malicious Git config. From a RealGround perspective, this is an AI agent abuse and supply chain risk demonstrating that agent integrations with developer tooling must explicitly constrain or review any auto-executed commands originating from project configuration files. Organizations should harden AI agents by auditing command execution paths, enforcing explicit user consent, and continuously red-teaming agent behavior against poisoned repositories and build configurations.