Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code

Summary

Eight security flaws in seven AI coding agents allow malicious Git configurations to execute attacker code. Exploitation requires repositories with intact .git directories. Fixes are pending for some agents, while others have released patches.

Key Takeaways

1. Eight security flaws in seven command-line AI coding agents allow a repository's Git configuration to execute attacker code on a developer's machine without an approval prompt.
2. Exploitation requires the repository to arrive as files with its .git directory intact, preserved through shared archives, drives, sync folders, or USB sticks, but not ordinary clones.
3. Four of the disclosed vulnerabilities remain unpatched at the time of publication, affecting agents like Hermes Agent, Qwen Code, and Grok Build.

Statement Breakdown

• Claimed Facts: 60% of statements the article presents as facts
• Opinions: 20% of statements classified as editorial or subjective
• Claims: 20% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The article presents technical details and specific CVEs, indicating a degree of factual reporting. However, it relies heavily on a single research group's findings and lacks independent verification of all claims. The inclusion of unpatched vulnerabilities and potential for exploitation warrants caution.

Bias assessment: Security Vulnerability Focus. The article's primary focus is on identifying and detailing security vulnerabilities within AI coding agents. It highlights potential risks and the technical mechanisms of exploitation, framing the subject matter through a lens of cybersecurity threats.

Note: This article details technical security vulnerabilities. While it provides specific information, some claims are based on research findings that may not be fully independently verified. Readers should exercise caution and consult official vendor advisories for the most up-to-date information.

Credibility flag: Technical, Caution Advised

Claimed Facts (7)

• This is a direct statement of fact about the number of flaws and their status.
• This provides specific details on which agents have been fixed and which are still vulnerable.
• This states a factual event regarding CVE publications by OpenAI.
• This is a technical description of how the vulnerability functions within Codex.
• This explains the technical mechanism of the Git configuration setting involved.
• This reports a specific CVE assignment and its associated score.
• This details past reports and findings by Sonar regarding similar vulnerabilities.

Opinions (5)

• This is an interpretation and assessment of the nature of the vulnerability.
• This is an explanatory statement that interprets the implications of the vulnerability's execution flow.
• This is an analytical statement that characterizes the vulnerability as an exploitation of a feature rather than a bug.
• This statement describes the potential consequences of the exploit, which is an interpretation of its impact.
• This is a statement about the reporting and closure of a finding, including Manifold's assertion about its status.

Claims (5)

• This is a claim about the completeness of vendor advisories, which is difficult to independently verify from the article alone and could be subject to interpretation.
• The withholding of a key piece of information (the configuration key) makes this claim difficult to verify and potentially incomplete.
• The discrepancy between the assigned CVE and its absence in a primary database raises questions about the claim's validity or completeness.
• This describes the internal handling of a report by xAI, which is presented as fact but is based on their internal processes and may lack external corroboration.
• This claim about "separate research" and how xAI addressed it is presented without direct attribution or verification within the article.

Key Sources

• Manifold Security — Security Research Firm
• goose — AI Coding Agent
• Claude Code — AI Coding Agent
• Cursor — AI Coding Agent
• Hermes Agent — AI Coding Agent
• Qwen Code — AI Coding Agent
• Grok Build — AI Coding Agent
• OpenAI — AI Research Company
• Codex — AI Coding Agent
• Git — Version Control System
• GitHub — Code Hosting Platform
• Sonar — Security Research Firm
• Anthropic — AI Research Company
• Cobalt — Cybersecurity Firm
• The Hacker News — Cybersecurity News Outlet
• Francisco Rosales — Security Researcher
• xAI — AI Company