Manifold Security disclosed eight security flaws across seven command-line AI coding agents that allow attackers to execute arbitrary code on developer machines through malicious Git configurations. Four of the affected tools remain unpatched as of publication.
The vulnerability stems from how these AI agents handle repository Git configurations. When a developer clones a malicious repository, the attacker embeds a custom Git command in the repository's configuration file. The AI agent then executes this command directly on the developer's machine without sandboxing protection or user approval. The code runs with the same privileges as the developer who invoked the agent.
Affected tools include Claude, Codex, Cursor, and four other command-line AI coding agents. The vulnerability requires minimal attacker effort. The malicious repository merely needs to reach the target developer, either through social engineering, a compromised package repository, or distribution via public code hosting platforms like GitHub.
The attack bypasses the sandbox protections these agents claim to provide. Many AI coding assistants advertise isolated execution environments for untrusted code. This vulnerability exposes a gap in that security model. Git configuration parsing happens outside the sandbox boundary, creating a direct path to the host system.
Impact varies by the compromised agent. In many cases, an attacker gains immediate code execution with the developer's user account privileges. They can steal credentials, inject malware into the development environment, modify source code before compilation, or pivot to internal systems the developer can access. For developers working on sensitive projects or with elevated permissions, the risk escalates further.
Manifold Security notified affected vendors but did not name all four unpatched tools at publication time, likely to avoid weaponization before patches deploy. The researchers recommend developers immediately stop cloning repositories from untrusted sources until vendors patch this class of vulnerability.
The core issue reflects a broader problem in AI agent design. These tools operate in environments with complex, overlapping trust boundaries. Developers expect sandboxing to prevent untrusted code execution, but Git configuration parsing, shell integration, and language-specific setup scripts often execute at higher privilege levels than application code itself.
Vendors have several remediation paths. The most direct involves disabling arbitrary Git configuration execution or requiring explicit user approval before running any commands originating from repository metadata. Some vendors may sandbox Git configuration parsing itself, though this adds complexity. Others could implement allowlists for permitted Git configuration keys and commands.
This disclosure also highlights the tension between developer convenience and security in AI-assisted development. Agents designed to be helpful automatically parse configuration and execute setup commands to speed up workflows. Each automation point becomes a potential attack surface.
The incident underscores why developers should remain cautious when adding AI agents to their workflows. These tools introduce new code execution pathways that traditional security practices may not account for. Organizations deploying AI coding agents should treat repository sources as seriously as they treat code dependencies and implement the same supply chain controls they apply to package managers.