Malicious .git configs trigger Claude, Codex, Cursor and other AI agents to run attacker code
agents claude cursor
| Source: Mastodon | Original article
Researchers have found that malicious .git configuration files can cause AI coding agents such as Claude, Codex, and Cursor to execute attacker‑controlled commands, exposing a new security risk beyond the models themselves.
Researchers have uncovered a new class of vulnerabilities that let malicious .git configuration files execute attacker‑controlled commands inside popular AI coding agents such as Claude Code, Codex, Cursor and several others. The flaw, dubbed “GitSpawn,” was disclosed on 2 September 2026 and hinges on a single line in a project’s .git/config file. When an AI‑assisted development tool reads the repository, the crafted config triggers code execution before the user even begins typing.
One concrete example involves Claude Code’s “ultrareview” pathway, which activates a hidden Git configuration key that Manifold has not publicly documented. Manifold confirmed that the issue is live in version 2.1.252 released on 1 September, while the current stable release is 2.1.258. The vulnerability surfaces at different stages across agents – some fire before trust is established, others before authentication, and a few on the very first keystroke – creating a broad attack surface that extends far beyond the underlying language model.
The discovery matters because AI coding assistants are increasingly embedded in development pipelines, CI/CD systems and even public‑service platforms. An attacker who can inject a malicious .git/config into a repository could hijack the agent to run arbitrary commands, steal credentials, or corrupt codebases, effectively turning a productivity tool into a conduit for supply‑chain attacks.
Vendors are now racing to patch the issue. Watch for updated releases from Anthropic, OpenAI, Cursor, and other tool providers that harden repository handling and validate Git settings before execution. Security researchers are also likely to publish mitigation guidelines for developers, emphasizing safe repository sourcing and sandboxed agent runtimes. The episode underscores the need to treat AI‑augmented tooling as part of the broader software attack surface, not just as isolated models.
Sources
Back to AIPULSEN