{"data":{"id":"c41d5118-9c3e-415e-b7bf-5b02ba0c9162","title":"Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code","summary":"Manifold Security disclosed eight flaws across seven command-line AI coding agents in which a repository's Git configuration names a command the agent runs on the developer's machine, outside the sandbox and without an approval prompt. Exploitation requires the repository to arrive with its .git directory intact, as with shared archives, shared drives, sync folders, or USB sticks, but not with an ordinary clone. Fixes have shipped for goose, Claude Code, and Cursor, while Hermes Agent, Qwen Code, Grok Build, and a second Claude Code path remained unpatched when Manifold retested them on September 1.","solution":"Fixed in 1.44.0 for goose (prior versions affected); fixed in 0.131.0 for Codex CLI; fixed in 26.519.22136 for Codex Desktop for macOS; fixed in 26.519.21041 for Codex Desktop for Windows and 26.519.2081.0 for the Microsoft Store package; fixed by 2.1.196 for Claude Code on the core.fsmonitor path. Fix pending for Hermes Agent, Qwen Code, and Grok Build.","labels":["security","industry"],"sourceUrl":"https://thehackernews.com/2026/09/malicious-git-configs-can-make-claude.html","publishedAt":"2026-09-02T14:06:59.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["other"],"issueType":"news","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["Anthropic","OpenAI"],"affectedVendorsRaw":["Claude Code","Claude","Codex","Codex CLI","Codex Desktop","Cursor","goose","Hermes Agent","Qwen Code","Grok Build"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-09-02T14:06:59.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}