Manifold Security has reported the discovery of eight security vulnerabilities across seven distinct command-line AI coding agents. The core mechanism of these flaws involves a malicious Git configuration file within a repository, which can instruct the AI agent to execute an arbitrary command on the developer's machine. Four of these identified vulnerabilities remain unpatched at the time of the report's publication.
The reported vulnerabilities leverage the way certain AI coding agents interact with Git repositories. Specifically, a repository's `.git/config` file can be crafted to specify a command that the agent then executes. This execution occurs with the privileges of the user running the agent and bypasses any sandboxing mechanisms the agent might employ. Furthermore, the execution proceeds without requiring an explicit approval prompt from the user, making the attack potentially stealthy.
For successful exploitation, the malicious repository must be introduced to the developer's system. This typically implies that the developer either clones a repository containing the malicious configuration or initializes a repository from untrusted sources. Once the repository is present and the AI agent interacts with it in a manner that triggers the Git configuration, the embedded command is executed.
The affected AI agents include those from prominent developers such as Claude, Codex, and Cursor, among others. Products in this category are designed to assist developers by automating coding tasks, generating code, or providing intelligent suggestions. Their integration with version control systems like Git is a common feature, enabling them to operate directly within a developer's workflow.
Mitigation for this class of vulnerability generally involves exercising caution when interacting with untrusted repositories. Developers should avoid cloning or initializing Git repositories from unknown or unverified sources. Additionally, security best practices suggest reviewing the contents of `.git/config` files, especially in new or unfamiliar repositories, before allowing AI agents or other tools to interact with them. Vendors of AI agents are also expected to implement more robust parsing and execution policies for Git configurations, potentially by disallowing arbitrary command execution or by introducing explicit user prompts for such actions.
This discovery highlights a broader security concern at the intersection of AI development tools and established software development practices. As AI agents become more deeply integrated into the development lifecycle, the potential for novel attack vectors that exploit the trust placed in these tools and their underlying infrastructure increases. It underscores the ongoing need for rigorous security auditing of AI-powered development tools and for developers to maintain vigilance regarding the provenance of their code and development environments.
