Poisoned Git Configs Trick Claude, Codex and Cursor Into Running Attacker Code
Manifold Security found eight flaws in seven command-line AI coding assistants that let a booby-trapped repository run commands on a developer's machine without asking permission.
Key points
- Manifold Security disclosed eight vulnerabilities across seven command-line AI coding agents, including Claude Code, OpenAI Codex CLI and Cursor CLI.
- A poisoned Git configuration file inside a repository tells the agent to run an attacker's command on the developer's machine.
- Four of the eight flaws remained unpatched when the research was published.
- Commands run as the logged-in user, outside the agent's safety sandbox, with no approval prompt shown.
- Any developer who clones or opens an untrusted repository with one of these tools is exposed.
A single hidden file in a code repository can quietly hijack the AI coding assistants that developers now reach for daily. That's the finding from Manifold Security, which we first covered on 15 July 2026 and whose latest disclosure follows a pattern we reported on 4 August: configuration files weaponised against the tools that read them.
First reported by The Hacker News, the research identifies eight separate bugs across seven command-line agents. Four were still unpatched when the write-up went live.
What is the actual trick?
Every code project carries a Git configuration file to tell Git how to behave. An attacker plants a line in that config naming a command they want to run. When the developer opens the poisoned project with one of the vulnerable agents, the agent reads the config and runs that command. It runs as the developer, with the developer's permissions, on the developer's machine. No pop-up, no sandbox (the isolated safety cage the agent normally keeps risky commands inside), no prompt of any kind.
The same shape of bug appears across seven different products. That's not a coincidence; it reflects a shared assumption that a repository's own config is trustworthy.
Why does this matter to non-developers?
These AI assistants are being rolled out inside companies fast. A data analyst or a junior engineer might clone a repository from a link in a chat message, a job posting, or a public code-sharing site. If they open it in one of these agents, the attacker's code runs. That could mean stolen cloud credentials or a foothold for ransomware, malicious software that locks a company's files until a ransom is paid.
Loading the project is enough. The person opening the folder doesn't need to type anything unusual.
Which tools are affected?
Manifold's disclosure covers seven command-line AI coding agents. The researchers tested each against the same poisoned-config technique and logged which vendors had shipped fixes.
| Detail | Figure |
|---|---|
| Agents tested | 7 |
| Distinct flaws found | 8 |
| Patched at disclosure | 4 |
| Unpatched at disclosure | 4 |
| Approval prompt shown | None |
Named products include Anthropic's Claude Code, OpenAI's Codex CLI and Cursor CLI. Manifold has withheld specifics for the tools that are still unfixed.
How did this slip past the vendors?
The agents were built to work with Git, the version-control system almost every software project uses. Running Git commands on the user's behalf is a feature. The gap is that the agents trusted the repository's own config to name those commands. A hostile repo names a hostile command, and the agent doesn't flinch.
Approval prompts exist in most of these tools for shell commands the AI itself proposes. They weren't wired up for commands that Git pulls from a config file. That's a meaningful distinction, and it's the one that got missed across seven products simultaneously.
Should you worry?
If you're a developer, yes, in proportion. Update affected agents as soon as vendors publish patches and check release notes for any mention of Git config handling. Until then, don't open untrusted repositories inside a command-line AI agent on a work machine. Cloning into a throwaway virtual machine is the safest habit for anything from a stranger.
Security teams should check whether developers are running these agents with access to production credentials and pull that access back where possible.
Expect more bugs of this shape. AI agents that touch the file system are a new attack surface, and Git configs are only one lever an attacker can pull.
