When you clone a repository, you expect your AI coding assistant to help write code. You don't expect it to execute an attacker's commands without asking.
That's exactly what happened with eight vulnerabilities disclosed by Manifold Security across seven command-line AI coding agents. The attack vector? Malicious Git configurations that exploit how these agents interact with version control.
What Happened
Manifold Security found that AI coding agents read and trust Git configuration files without validating their contents. An attacker can embed malicious commands in .git/config or related files. When the agent processes these configurations, it executes the attacker's code on your machine.
OpenAI published three CVEs related to these vulnerabilities. As of disclosure, four of the eight flaws remain unpatched.
The attack works because Git's configuration system allows custom commands through hooks, aliases, and external diff tools. AI agents that parse these configurations to understand repository context inadvertently trigger the malicious commands. No user approval is required.
Timeline
The exact discovery and disclosure timeline isn't public, but the pattern is clear:
- Manifold Security identified the vulnerabilities across multiple AI coding agents.
- OpenAI published three CVEs documenting the issues.
- Some vendors patched their agents; others did not.
- Four vulnerabilities remain unpatched at publication.
These aren't zero-days that got fixed in 48 hours. These are architectural issues in how AI tools interact with Git. The unpatched vulnerabilities mean your team could be exposed right now.
Which Controls Failed
Input validation. The agents trusted Git configuration files as safe data sources. They should have treated them as untrusted input requiring validation and sanitization.
Least privilege. The agents ran with enough permissions to execute arbitrary commands from configuration files. They needed isolation from system-level operations.
User consent. Critical operations executed without explicit approval. Any action that runs code from an external source should require user confirmation.
Secure defaults. The agents enabled dangerous Git features by default. They should have disabled hooks, aliases, and external commands unless explicitly enabled.
What Standards Require
OWASP ASVS v4.0.3 Requirement 5.2.1 states: "Verify that all untrusted HTML input from WYSIWYG editors or similar is properly sanitized with an HTML sanitizer library or framework feature." While this addresses HTML specifically, the principle extends to all untrusted input. Git configuration files from cloned repositories are untrusted input.
NIST 800-53 Rev 5 Control SI-10 requires information input validation: "Check the validity of information inputs." Your AI agents must validate Git configurations before processing them, just as they would validate API responses or user-supplied data.
ISO/IEC 27001:2022 Annex A.8.3 addresses media handling: "Media shall be protected against unauthorized access, misuse or corruption during transport." Git repositories are media. The configurations they contain require the same scrutiny you'd apply to files downloaded from the internet.
PCI DSS v4.0.1 Requirement 6.2.4 mandates: "Bespoke and custom software are developed securely." If you're integrating AI coding agents into your development workflow, you're responsible for ensuring they don't introduce vulnerabilities. That includes auditing how they interact with Git.
Lessons and Action Items
Audit your AI agent configurations immediately. List every AI coding tool your team uses. Check which ones interact with Git. Review their documentation for security guidance on Git integration.
Disable Git hooks in agent environments. Run git config --global core.hooksPath /dev/null to prevent hook execution. Most AI agents don't need hooks to function. If yours does, document why and implement monitoring.
Implement allow-lists for Git commands. If your agents support it, restrict which Git operations they can perform. Reading commit history? Fine. Executing custom diff tools? No.
Require user approval for external commands. Configure your agents to prompt before running any command that originates from a repository configuration. This adds friction, but it's necessary friction.
Separate development and production Git configurations. Don't use the same Git setup for your AI agents that you use for production deployments. Your agents need a locked-down configuration profile.
Monitor for suspicious Git configurations. Add checks to your CI/CD pipeline that scan for dangerous Git config patterns: hooks, aliases that execute shell commands, external diff or merge tools. Flag repositories that contain them.
Update patched agents now. If your vendor released a fix, deploy it. Don't wait for your next maintenance window. These vulnerabilities allow remote code execution.
For unpatched agents, restrict repository sources. If you're using an agent that hasn't been fixed, only clone repositories from trusted sources. Better yet, switch to a patched alternative until the vendor responds.
Document your AI agent security posture. Your compliance framework requires you to know what software you're running and how it's secured. Add AI coding agents to your asset inventory. Document their Git interaction model. Include them in your vulnerability management program.
The core problem isn't that Git configurations can execute code. That's a feature. The problem is AI agents treating these configurations as trusted data. Your job is to ensure your team's tools recognize the difference between a helpful configuration and a malicious one.
Start with the audit. You can't fix what you don't know you're running.
