Your AI coding agent vulnerable to attacks from opened repositories
agents
| Source: Dev.to | Original article
AI coding agents can be compromised by malicious repositories they open, allowing attacks without developers manually running harmful code.
A security firm has uncovered a new supply‑chain attack vector that lets a malicious Git repository hijack popular AI coding assistants. Manifold Security’s “GitSpawn” disclosure, published on September 1‑2 2026, shows that a single line in a repository’s configuration file can commandeer seven of the most widely used command‑line coding agents, including Anthropic’s Claude Code, OpenAI’s Codex, Cursor, Cognition’s Goose and Hermes Agent. The flaw works because modern agents do more than autocomplete code – they read repository metadata, execute shell commands, access credentials and invoke external tools through their built‑in tool‑calling interfaces. When a repository contains a crafted Git config entry, the agent follows the instruction automatically, effectively turning the repository itself into an active part of the attacker’s payload.
The discovery builds on earlier warnings that AI assistants have become a new attack surface. In August 2026 we reported that agents can read AGENTS.md files and other agent‑specific scripts, and a June 2026 investigation showed how clean‑looking GitHub repos were being used to compromise them. GitSpawn demonstrates that the threat has moved from passive code injection to active manipulation of the agent’s execution environment, raising the stakes for developers who rely on AI helpers for code generation, debugging or deployment.
Mitigation will now hinge on rapid patching and tighter validation of repository metadata. Vendors have begun issuing updates, but the breadth of the flaw means many installations remain vulnerable. Security researchers recommend scanning repositories with the open‑source skill scanners highlighted in the August 2026 “Top AI Coding Agent security resources” guide, and adopting a zero‑trust stance toward any external repo the agent accesses. Watch for vendor patch roll‑outs over the coming weeks and for industry‑wide guidelines on hardening AI coding agents against malicious configuration files. As we reported on September 19 2026, Claude Code now reads AGENTS.md automatically – a convenience that, without proper safeguards, can become a conduit for the very attacks GitSpawn exploits.
Sources
Back to AIPULSEN