A malicious .git file can execute code in Claude Code, Codex, and Cursor

The Hacker News documents a new class of attack: malicious .git configurations that, when read by AI coding agents, execute attacking code. The tools meant to secure become vectors.

The Facts

The Hacker News reported on September 2, 2026, a newly documented attack technique: Git configuration files—the classic .git/config present in every repository—can be crafted to execute arbitrary code on AI coding agents when they open or analyze the repository.

Affected agents include:

• Claude Code (Anthropic)
• Codex (OpenAI)
• Cursor (the agentic IDE)
• And other tools that rely on Git commands in the background to index, analyze, or modify a repository.

The vector: Git allows certain directives in its configuration (hooks, aliases, filters) that trigger the execution of shell commands. An AI agent that "takes over" a cloned repository—to analyze it, commit changes, or run tests—executes these commands with the rights of the user who launched the agent.

Who Is Affected

• Developers using Claude Code, Codex, Cursor, or any other agent that manipulates a local Git repository.
• Teams that allow their AI agents to clone or analyze public repositories (external PR reviews, open-source exploration, issue triage).
• CI/CD pipelines that delegate steps to AI agents on untrusted repositories.

The most dangerous scenario: an attacker publishes a malicious repository on GitHub, a developer asks their agent to "analyze this project," and the agent silently executes the payload embedded in the .git/config—with access to everything the developer can read (SSH keys, tokens, private files).

Why This Matters

This family of attacks flips the usual narrative. Until now, AI coding agents were presented as defensive reinforcements: they read code, detect vulnerabilities, and produce patches. Here, they become the attack surface. Malicious code doesn’t need to be executed by a human: it just needs an agent to read the Git config.

We’ve been tracking the rise of autonomous AI agents as intrusion vectors—DeepSeek on servers, Claude breaching three organizations, Azure DevOps MCP hijacked, Cursor used by Aurora Ransomware to generate payloads. The novelty here is that it’s not the agents attacking; it’s the agents being attacked through a mundane artifact—a config file no one ever reads.

What to Do Now

• Never let an AI agent analyze an unknown repository without cleaning it first: run git config -file .git/config -unset-all on sensitive directives (core.hooksPath, core.fsmonitor, suspicious aliases) before analysis.
• Isolate agent execution: use a dedicated container, without mounted SSH keys or sensitive tokens.
• Audit your CI/CD workflows: any agent manipulating a third-party repository must run in a disposable environment.
• Monitor patch announcements: Anthropic, OpenAI, and other affected agent vendors will need to harden their Git runners.

Key takeaway: the security of AI coding agents is no longer just about the prompt, but about every artifact they touch—Git configs, project files, hooks. Treat every unknown repository like an unsigned binary: in a sandbox, never on your dev machine.