What Happened
Manifold Security disclosed eight vulnerabilities across seven command-line AI coding agents, including Claude Code, Codex, Cursor, Hermes Agent, Qwen Code, Grok Build, and goose, sharing one design flaw: when an agent runs a routine git command inside a repository, it also executes any command named in the repository’s own .git/config file. A poisoned repository cannot spread through a normal git clone, fetch, or pull, since those operations never transmit a hostile config file. Instead, the payload arrives as files with the .git directory intact, through a zipped folder, a shared drive, or a USB stick, and fires the moment an agent inspects the folder. On Claude Code and Hermes Agent, the payload executes before the workspace-trust prompt appears, on Qwen Code before authentication, and on Grok Build on the first keystroke. Fixes shipped for goose, Claude Code, and Cursor, while Hermes Agent, Qwen Code, Grok Build, and a second path in Claude Code remained open at retest on September 1. OpenAI separately published three CVEs covering the same flaw class in Codex.
Why This Matters for Canadian Organizations
Canadian development teams have adopted AI coding agents inside sanctioned engineering workflows over the past year, often granting these tools full filesystem and shell access on developer machines to speed up code review and debugging. A payload firing before any trust prompt or authentication step defeats the permission systems these tools advertise as their core safety mechanism, meaning a developer opening a shared archive from a compromised colleague, contractor, or open source dependency hands an attacker code execution under their own account. This sits inside the software supply chain risk OSFI B-13 asks federally regulated institutions to manage, extending exposure beyond package registries and CI pipelines into the individual developer workstation.
What to Do
Development teams running Claude Code, Cursor, or goose should confirm they are on the patched release, and teams running Hermes Agent, Qwen Code, or Grok Build should treat these tools as unsafe against untrusted repository content until a fix ships. Engineering leads should update onboarding procedures to prohibit opening shared project archives with an AI coding agent before human review, since the .git directory travels silently inside a zip file or synced folder. Security teams should add .git/config auditing to code review checklists for repositories arriving from outside the organization’s own version control system. Full technical detail is available from The Hacker News.
