Security researchers found eight vulnerabilities in seven AI coding agents that let malicious Git configs execute attacker code on your machine — without approval and outside the sandbox. Four remain unpatched. Here's what you need to know.
You trust your AI coding assistant to help you write better code, spot bugs, and speed up your workflow. But what if that same assistant could be silently weaponized against you?
Security researchers at Manifold Security just dropped a bombshell: they've uncovered eight distinct security flaws across seven popular command-line AI coding agents. The attack vector is sneaky — it hides right inside a repository's own Git configuration.
Here's the scary part: the malicious command runs as you, the user. It executes outside the agent's sandbox. And it doesn't even ask for your approval first.
### The Attack: It's All in the Git Config
Let's break this down in plain English. When you clone a repository from the internet, you're not just downloading code — you're also pulling in configuration files. Those files can include Git hooks and aliases.
An attacker can craft a malicious repository where the .git/config file names a specific command. When your AI agent interacts with that repo, it unknowingly runs that command on your machine.
Think of it like this: you hire a personal assistant to help organize your office. Your assistant picks up a file from a stranger, and that file contains instructions that tell your assistant to open your safe. The assistant thinks it's just doing its job. But really, it's handing the keys to a thief.
### The Scope: Four Flaws Still Unpatched
Manifold Security's findings are troubling, but the timeline makes it worse. At the time of publication, four of these eight vulnerabilities still had no patches available.
That means if you're using one of the affected tools, you're currently exposed. No update to install. No fix to apply. Just a waiting game.
The affected agents include big names like Claude, Codex, and Cursor, along with several other command-line coding tools that developers rely on daily.
### Why This Matters for Developers
If you're a developer using AI-assisted coding tools, this isn't just academic. This is a real, exploitable path that could compromise your entire development environment.
Here's what makes this attack particularly nasty:
- **No approval prompt needed** — The command executes silently, without asking for your permission.
- **Runs outside the sandbox** — Even if your agent has built-in protections, this bypasses them entirely.
- **Executes with your privileges** — The malicious code runs as you, meaning it can access everything you can access.
### How to Protect Yourself Right Now
While we wait for vendors to ship patches, there are steps you can take to reduce your risk:
- **Be selective about repositories** — Only clone code from sources you trust. If a repo looks sketchy, it probably is.
- **Review Git configs manually** — Before letting an AI agent loose on a new repository, take a quick look at its config files.
- **Use isolated environments** — Consider running AI agents in containers or virtual machines where damage can be contained.
- **Monitor agent activity** — Keep an eye on what your agents are doing, especially when they're working with unfamiliar code.
### The Bigger Picture
The rise of AI coding agents has been meteoric. Tools like Claude, Codex, and Cursor promise to make developers more productive than ever. But with that convenience comes a new attack surface that traditional security measures weren't designed to cover.
"This is a wake-up call for the entire AI tooling ecosystem," says one industry observer who asked to remain anonymous. "We're building on trust, and attackers are already figuring out how to exploit that trust."
### What the Vendors Are Saying
At press time, some vendors had acknowledged the issues and were working on fixes. Others remained silent. The lack of coordinated disclosure is itself a concern for security professionals who track these kinds of threats.
For now, the best advice is to stay informed, stay cautious, and don't blindly trust your AI assistant with every repository you encounter. Your coding buddy is powerful — but it can also be turned against you.
### Final Thoughts
This discovery underscores a fundamental truth about AI-assisted development: the tools that make our lives easier also introduce new risks we haven't fully mapped yet.
The vulnerabilities Manifold Security found aren't exotic exploits requiring sophisticated hardware or nation-state resources. They're simple configuration tricks that any reasonably skilled attacker could pull off.
So before you let your AI agent run wild on the next open-source project you find, take a breath. Check the repo. Check the config. And remember: even your smartest assistant can be tricked into doing something dumb.
Stay safe out there, and keep your code — and your machine — protected.
