Malicious Git Config Command Execution in AI Coding Agents
First seen Sep 3, 2026 · Updated Sep 3, 2026 · CVSS 8.1
Manifold Security found eight flaws in seven popular command-line AI coding agents (including Claude Code, Codex, and Cursor) where a malicious repository's Git configuration can specify a command that the agent automatically executes on the developer's machine. This execution happens outside the agent's sandbox and without any user approval prompt, meaning simply cloning or opening a booby-trapped repo can lead to arbitrary code execution as the developer's user. Four of the eight issues remained unpatched at the time of publication.
Technical Analysis
AI coding agents that shell out to git or parse repository metadata can be tricked into invoking attacker-controlled commands defined in a repo's .git/config (e.g., core.pager, core.fsmonitor, hooks, or similar config-driven command hooks) as part of normal git operations the agent performs. Because the agent treats git-config-driven behavior as trusted local tooling rather than untrusted repository content, the command runs with the full privileges of the developer's user account and outside the agent's sandboxing/approval layer. The entry point is a malicious or compromised git repository that the victim clones, opens, or has the agent operate on; the attacker gains arbitrary local code execution, potentially leading to credential theft, lateral movement, or further supply-chain compromise. This crosses the tool boundary because the agent's trust in 'its own' git tooling is exploited to execute attacker logic that the agent's safety/sandbox controls were designed to prevent.
Affected Systems
Claude Code, Codex, Cursor, and unnamed other CLI-based AI coding agents
Detection Signatures
- Unexpected git config entries such as core.pager, core.fsmonitor, or custom hooks pointing to scripts/binaries in cloned repos
- Agent process spawning shell commands immediately after git clone/checkout/status without user approval prompt
- Outbound network or file-write activity correlated with git operations performed by an AI agent
- Repositories containing unusual or obfuscated .git/config or .git/hooks content
- Process execution logs showing agent binary as parent of unexpected child processes tied to repository open/clone events
Remediation Steps
- 1
Patch/update agent CLIs
Apply vendor patches for Claude Code, Codex, Cursor, and other affected agents as they become available; track the four still-unpatched issues for fixes.
- 2
Sandbox all git operations
Ensure AI coding agents execute git commands within the same sandbox/approval boundary as other tool calls, never bypassing user confirmation for config-driven command execution.
- 3
Untrust repository-supplied config
Configure agents and git itself to ignore or explicitly prompt before honoring repository-local config values that can trigger command execution (core.pager, hooks, fsmonitor, etc.).
- 4
Clone in isolated environments
Open or analyze untrusted repositories only in disposable containers/VMs, not directly on developer workstations, until agent fixes are confirmed.
- 5
Monitor process trees
Deploy EDR rules to flag child processes spawned by AI coding agent binaries immediately following git operations on newly cloned repos.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.