GermanyThe security firm Manifold has identified a vulnerability in manipulated git repositories that could allow malicious code execution through AI coding agents. These repositories contain commands in their configuration that are automatically executed by AI agents when opening them, granting full developer rights outside of sandbox environments without authentication or trust verification. Developers become victims as soon as they open such a repository. When opening a repository, AI agents often perform background git queries like 'git status' or 'git diff', using the complete local git configuration outside of sandboxing before any trust approval. The 'fsmonitor' feature in git allows external commands to be executed, which can be exploited if the command is malicious. Cloning, pulling, or fetching from remote repositories does not pose a risk, but receiving a repository as a zip file from colleagues and importing it into the system can be problematic. Manifold informed several developers of this vulnerability, but some have yet to patch it, including Qwen and Grok. Anthropic addressed the 'fsmonitor' issue but not a similar one related to 'claude ultraview'. Developers are advised,
Bias read (Center): The article discusses a technical vulnerability in software development tools and provides mitigation strategies. It does not involve political figures, policies, or contentious issues. The content is purely technical and neutral in tone.
