Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code
Summary
Manifold Security has found eight security flaws in seven AI coding agents, including Claude, Codex, and Cursor. These vulnerabilities allow malicious `.git` configurations within a repository to execute attacker-controlled commands on a developer's machine without their explicit approval or sandboxing.
IFF Assessment
This article highlights vulnerabilities in AI coding agents that could be exploited by attackers to run arbitrary code on developer machines, posing a direct threat to code integrity and system security.
Severity
The CVSS score of 8.8 (High) reflects a critical vulnerability where an attacker can execute arbitrary code on the target system without user interaction (Attack Vector: Network, Attack Complexity: Low, Privileges Required: None, User Interaction: None, Scope: Changed, Confidentiality: High, Integrity: High, Availability: High). The exploitation requires the attacker to control the repository's `.git` configuration, which can be achieved through social engineering or compromising a repository.
Defender Context
Developers using AI coding agents need to be vigilant about the repositories they clone and work with. Malicious `.git` configurations can lead to code execution vulnerabilities, making it crucial to vet the source of code and be aware of potential supply chain attacks targeting development tools.