Malicious .git Configurations Can Make AI Agents Execute Attacker Code

Manifold Security disclosed eight security flaws across seven command-line AI coding agents. A repository’s .git/config can specify a command that the agent executes on the developer’s machine with the user’s privileges, outside the agent’s sandbox and without an approval prompt. Exploitation requires the repository to arrive as files with its .git directory intact; an ordinary clone does not preserve this condition.