Open a folder with Claude Code and it runs `git status` before you type anything. Before the workspace-trust prompt. On some agents, before you have even authenticated. If that folder came from somewhere else, the repository decides what that command runs. [...] What an attacker gets. Arbitrary code execution as the developer, outside the sandbox, with no approval prompt and nothing on screen. Their SSH keys, the cloud credentials in their environment, the tokens in their shell config, every repository on disk, and a foothold on the machine. [...] [...]
An AI coding agent works out where it is by running git in the background, and git reads its settings from the repository it has been pointed at. One of those settings names a helper program git runs whenever it refreshes its index, so a repository that arrives as files rather than as a clone gets to name the command. Manifold Security published the same mistake in seven agents on 1 September 2026, four of the eight findings still live at publication. The part worth sitting with is that five of the reports came back as duplicates of findings other researchers had filed independently, one of them on the same day. This was not a clever exploit but one assumption that seven separate products made, found from several directions at once. The researchers' own mitigation: turn the setting off globally, and read a folder's git config before opening it with an agent.
Francisco Rosales, Manifold Security, in Manifold Security
