Git configuration flaws expose several AI coding agents to local command execution

Manifold Security disclosed eight flaws across seven command-line AI coding agents that can cause a repository's Git configuration to name a command executed on a developer's machine. The article says exploitation requires a received repository with its .git directory intact, rather than an ordinary clone. It reports fixes for goose, Claude Code and Cursor; Hermes Agent, Qwen Code, Grok Build and a second Claude Code path remained unpatched at publication. OpenAI published three CVEs covering the class in Codex, according to the article.