Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code

Researchers at Manifold Security have identified eight security vulnerabilities in seven command-line AI coding agents. These flaws allow a repository's Git configuration to specify a command that the agent will execute on the developer's machine. The command runs outside of the agent's sandbox and without prompting for approval, executing with the user's privileges. Four of the identified vulnerabilities remain unpatched. Exploitation of these vulnerabilities requires the repository to be accessed by the target. The affected agents include Claude, Codex, and Cursor, among others.