Malicious Git Configs Can Trigger Code Execution in Claude, Codex, Cursor, and Other AI Coding Agents

Security researchers at Manifold Security have disclosed eight vulnerabilities spanning seven command-line AI coding agents, including Claude, Codex, and Cursor. The flaws stem from a common pattern: agents reading a repository's own Git configuration and executing a command it names, on the developer's machine, without an approval prompt. At publication, four of the eight issues remained unpatched.

Why It Matters

The reported execution path runs outside the agent's sandbox and as the logged-in user, meaning it inherits whatever access that developer has — source code, credentials, cloud tokens, and other local resources. Because the trigger is a repository-level Git configuration rather than a prompt or file the agent explicitly executes, this affects any workflow where a coding agent is pointed at, or automatically opens, a repository whose provenance isn't fully trusted. Given how widely these agents are now embedded in developer tooling and CI-adjacent workflows, the exposure is broad wherever untrusted or third-party repositories are cloned or opened.

What Defenders Should Watch For

• Treat cloning or opening a third-party or untrusted repository with an AI coding agent as a code-execution risk, not just a code-review risk.
• Inventory which AI coding agents are in use across the org and check vendor advisories for patch status — Manifold reported four of eight issues still unpatched as of this disclosure.
• At a hunting level, look for unexpected child processes spawned by agent CLI tools (Claude, Codex, Cursor, etc.) shortly after a repository clone or open action, particularly processes invoking Git hooks, aliases, or configuration-driven commands.
• Where possible, restrict agent tooling from running unattended against repositories of unknown origin, and review sandboxing/approval settings for these tools rather than assuming defaults are safe.

This is a developing story based on a single vendor disclosure, and details on which specific agents and configuration vectors remain unpatched may evolve. For the full technical breakdown, see the original report at The Hacker News.