Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code

Summary

Manifold Security disclosed eight flaws across seven command-line AI coding agents in which a repository's Git configuration names a command the agent runs on the developer's machine, outside the sandbox and without an approval prompt. Exploitation requires the repository to arrive with its .git directory intact, as with shared archives, shared drives, sync folders, or USB sticks, but not with an ordinary clone. Fixes have shipped for goose, Claude Code, and Cursor, while Hermes Agent, Qwen Code, Grok Build, and a second Claude Code path remained unpatched when Manifold retested them on September 1.

Mitigation

Fixed in 1.44.0 for goose (prior versions affected); fixed in 0.131.0 for Codex CLI; fixed in 26.519.22136 for Codex Desktop for macOS; fixed in 26.519.21041 for Codex Desktop for Windows and 26.519.2081.0 for the Microsoft Store package; fixed by 2.1.196 for Claude Code on the core.fsmonitor path. Fix pending for Hermes Agent, Qwen Code, and Grok Build.

Topics

• AI agents

Related items

• InfoThe Web Is More Than Enough, by Paul FordSame vendor · Simon Willison's Weblog
• Infoparse_number() as a SQLite extension: C vs RustSame vendor · Simon Willison's Weblog
• InfoApple is racing to make Siri more agenticSame vendor · The Verge (AI)
• MediumRecent AI agent experiments reveal a risky future of machine 'teamwork' inside corporationsSame vendor · CNBC Technology
• InfoAnthropic IPO meets AI backlash after midterms show stinging rebuke of data centersSame vendor · CNBC Technology