Summary
- Manifold now reports eight related findings across seven AI coding agents, expanding its initial disclosure.
- Repository-controlled Git configuration can trigger host-level command execution while agents automatically gather project context.
- Four findings were patched by publication, while four remained reproducible on current releases as of 1 September.
AI coding agents can execute attacker-controlled commands from an untrusted repository before users have approved the workspace, according to research exposing a recurring trust-boundary flaw across several development tools.
Manifold Security now reports eight related findings across seven agents after examining how AI development tools automatically invoke Git while gathering project context. Four had been patched by publication, while four remained reproducible against current versions on 1 September.
The weakness is not a vulnerability in Git itself. Repositories can contain configuration that changes how certain Git operations behave, including settings capable of invoking external commands. When an AI agent automatically calls Git without removing repository-controlled configuration, opening or interacting with the project can cross from passive inspection into code execution.
The researchers documented the class across Claude Code, Goose, Grok Build, Hermes Agent, and Qwen Code. OpenAI’s Codex and Cursor were subsequently added to the affected set after Manifold said its reports for both products had been closed as duplicates of findings submitted by other researchers. Codex and Cursor have since been patched.
Several execution paths occurred unusually early in the workflow. Manifold found examples where commands could run before a workspace-trust prompt had appeared or been accepted, before authentication, or when a user began typing a prompt.
That ordering undermines a familiar security assumption in developer tooling: that an untrusted repository can be inspected safely until the user explicitly agrees to run its code. AI agents complicate the boundary because they autonomously collect context and invoke local tools before the user has necessarily asked them to perform an action.
The consequences can extend beyond the agent’s own sandbox. Manifold says the affected Git calls can execute on the host with the developer’s privileges, potentially exposing local repositories, SSH material, environment credentials, tokens, and other resources available to that account.
The disclosure also shows why fixing one dangerous Git configuration option may not be sufficient. Manifold found multiple settings capable of acting as command-execution sinks, including a second Claude Code path that remained vulnerable after a related mechanism had already been addressed.
Agentic development tools tend to operate with access that conventional editors do not require. Depending on configuration, they may be able to read and modify repositories, invoke shells, install packages, interact with development services, or use credentials already present in the local environment. An execution flaw during trust establishment therefore reaches into a broader set of assets than the coding interface alone.
The supply chain dimension is equally important. Developers routinely clone unfamiliar repositories, inspect contributions, review archived projects, and work with code generated outside their organisation. A malicious repository does not need to persuade a language model to follow an adversarial instruction if the surrounding agent invokes repository-influenced commands before trust has been established.
Manifold has not reported evidence that the flaws are being exploited in live attacks. Its findings instead identify a recurring architectural problem: context gathering has been allowed to run ahead of the security boundary intended to govern untrusted projects.
The updated disclosure also shows that this is not confined to one vendor’s implementation. Four findings have been fixed, including those affecting Goose, one Claude Code path, Codex, and Cursor, while Manifold said four remained unpatched at publication, including paths involving Qwen Code, Grok Build, Hermes, and Claude Code’s ultrareview function.
As AI development agents receive greater authority over local and remote systems, their startup sequence becomes part of the security perimeter. A trust prompt offers little protection if repository-controlled execution has already occurred before the user sees it.
