Poisoned Git Configs Trick Claude, Codex and Cursor Into Running Attacker Code
Manifold Security found eight flaws in seven command-line AI coding assistants that let a booby-trapped repository run commands on a developer's machine without asking permission.
Key points
- Manifold Security disclosed eight vulnerabilities across seven command-line AI coding agents, including Claude Code, OpenAI Codex CLI and Cursor CLI.
- The trick is a poisoned Git configuration file inside a repository that tells the agent to run an attacker's command on the developer's laptop.
- Four of the eight flaws remained unpatched when the research was published.
- The commands run as the logged-in user, outside the agent's safety sandbox, with no approval prompt shown.
- Any developer who clones or opens an untrusted repository with one of these tools is exposed.
A fresh piece of research from Manifold Security shows how a single hidden file in a code repository can quietly hijack the AI coding assistants that developers now use every day.
The target is the command-line versions of tools like Claude Code, OpenAI's Codex CLI and Cursor CLI. These are helpers that sit in a developer's terminal, read the code in a project, and suggest or run changes on request.
Manifold found eight separate bugs across seven of these tools. First reported by The Hacker News, four were still unpatched when the write-up went live.
What is the actual trick?
The attack hides inside a repository's Git configuration, the small settings file that every code project carries to tell Git how to behave. An attacker plants a line in that config naming a command they want to run.
When the developer opens the poisoned project with one of the vulnerable AI agents, the agent reads the config and dutifully runs that command. It runs as the developer, with the developer's permissions, on the developer's machine.
No pop-up. No "are you sure?" No sandbox, meaning the isolated safety cage the agent normally keeps risky commands inside.
That is the whole bug, and it is the same shape across seven different products.
Why does this matter to non-developers?
It matters because these AI assistants are being pitched as productivity tools and rolled out inside companies at speed. A designer, a data analyst or a junior engineer might clone a repository from a link in a chat message, a job application, or a public code-sharing site.
If they open it in one of these agents, the attacker's code runs. That could mean stolen browser sessions, stolen cloud keys, or a foothold for ransomware, which is malicious software that locks a company's files until a payment is made.
The person opening the folder does not need to type anything unusual. Loading the project is enough.
Which tools are affected?
Manifold's disclosure covers seven command-line AI coding agents. The researchers tested each one against the same poisoned-config technique and logged which vendors had shipped fixes.
| Detail | Figure |
|---|---|
| Agents tested | 7 |
| Distinct flaws found | 8 |
| Patched at disclosure | 4 |
| Unpatched at disclosure | 4 |
| Approval prompt shown | None |
Named products in the research include Anthropic's Claude Code, OpenAI's Codex CLI and Cursor CLI. Manifold has withheld some specifics for the tools that are still unfixed.
How did this slip past the vendors?
The agents were built to be helpful with Git, the version-control system almost every software project uses. Running Git commands on the user's behalf is a feature, not a bug.
The gap is that the agents trusted the repository's own config to name those commands. A hostile repo can name a hostile command, and the agent has no reason to flinch.
Approval prompts exist in most of these tools for shell commands the AI itself proposes. They were not wired up for commands that Git pulls out of a config file.
What should developers and their employers do?
Update the affected agents as soon as vendors publish patches, and check release notes for a mention of Git config handling. Until then, do not open untrusted repositories inside a command-line AI agent on a work machine.
Cloning into a throwaway virtual machine is the safest habit for anything from a stranger. Security teams should also check whether developers are running these agents with access to production credentials, and pull that access back where they can.
Expect more bugs of this shape. AI agents that touch the file system are a new attack surface, and Git configs are only one of the levers an attacker can pull.
