Malicious .git Configs Threaten AI Coding Agents

Manifold Security has identified eight critical security vulnerabilities affecting seven popular command-line AI coding agents, enabling attackers to execute arbitrary code on developer machines. These vulnerabilities, detailed in a disclosure on March 13, 2024, leverage the `.git/config` file within a code repository. Specifically, an attacker can craft a malicious `.git/config` file that names a command to be executed by the AI agent. When the AI agent processes a repository containing such a configuration, it runs the specified command with the user's privileges, bypassing standard security measures and sandboxing.

Four of these eight vulnerabilities remain unpatched at the time of disclosure, posing an immediate risk to developers using affected AI tools. The exploitation mechanism does not require user approval or an explicit prompt, making it particularly insidious. Developers who clone or pull code from a compromised repository could inadvertently trigger the execution of malicious commands. The affected AI agents include those developed by prominent entities in the AI and developer tool space, such as Anthropic's Claude, Microsoft's Codex, and Cursor, among others. The specific list of affected agents and their vendors was not fully detailed in the initial report, but the scope suggests a widespread potential impact across the developer ecosystem.

Manifold Security's research highlights a significant blind spot in the security protocols of AI coding assistants. These tools are designed to streamline development workflows by integrating deeply into the developer's environment, often by executing commands directly. However, this deep integration also creates an attack vector if the configuration files they rely on are not rigorously validated for malicious intent. The `.git/config` file is a standard component of Git, a distributed version control system widely used for software development. It stores repository-specific settings, including hooks and custom commands, which AI agents may interpret and execute as part of their functionality. The researchers emphasized that the commands are executed outside the AI agent's sandbox, meaning they have direct access to the developer's operating system and file system.

The implications of these vulnerabilities are substantial. A successful exploitation could lead to a full system compromise, including data theft, installation of further malware, or disruption of development processes. Developers are advised to exercise extreme caution when cloning repositories from untrusted sources and to review their `.git/config` files for any unusual or unexpected command entries. While specific patches are pending for the unaddressed vulnerabilities, the disclosure serves as a critical warning for both AI tool developers and the broader software development community regarding the security challenges posed by increasingly integrated AI agents.