Executive Summary
Manifold Security disclosed eight flaws across seven CLI AI coding agents, including Claude, Codex and Cursor, where a repository's own Git configuration names a command the agent runs on the developer's machine; four were unpatched at publication.
What Happened
Manifold Security has disclosed eight security flaws across seven command-line AI coding agents in which a repository's own Git configuration names a command that the agent runs on the developer's machine, four of them still unpatched at publication. The command executes as the user, outside the agent's sandbox and without an approval prompt, and exploitation requires the repository to arrive
Affected Products
- Claude Code
- OpenAI Codex CLI
- Cursor
Vulnerability / Attack Technique
Malicious .git configuration triggering command execution
Technical Mechanism
A cloned repository's Git config specifies a command that the agent invokes as the user, outside its sandbox and without an approval prompt.
AI Security Category
LLM03:2025 Supply Chain
Part of the AI Supply Chain and AI SBOM topic.
Relevant Frameworks
RealGround Analysis
Cloning a repository and pointing an agent at it can run attacker code. RealGround analysis: treat untrusted repositories as untrusted code even before building them.
Recommended Controls
- Update coding agents to patched versions
- Open untrusted repositories in a container or VM
- Disable Git config-defined commands for agent sessions
Related RealGround Service
Secure AI Agent Build · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/09/malicious-git-configs-can-make-claude.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-17.