One cloned repository can now hijack your AI coding assistant.
The tool your team trusts to write production code can be flipped into a channel for attacker commands, with no approval prompt in sight.
Manifold Security disclosed eight flaws across seven command line AI coding agents on September 2, 2026. Claude Code, Codex, and Cursor are all affected, and four of those flaws remain unpatched.
The trigger hides inside a repository's own Git configuration. The agent reads that config, then quietly runs the command it names on your machine.
Execution happens outside the agent's sandbox, with your full user permissions, and without warning you first. This is exactly the pattern that makes some engineering teams hit the brakes on AI coding before the tooling matures.
The supply chain attack of 2026 does not need a poisoned package, it needs one repository your coding assistant trusts.
Attackers are already treating these assistants as accomplices. Researchers tied the Aurora ransomware crew to intrusions scripted with Cursor, and recent work we covered showed an AI agent running a full ransomware attack with no human at the keyboard.
The credential stealers noticed too. GitGuardian found the Shai-Hulud infostealer now scans 469 credential locations, and its target list now includes AI tool configuration files, not just cloud keys and CI secrets.
So what changes in how you work today? Three moves make the biggest difference.
1. Treat every repository as untrusted input.
Do not let your agent execute custom commands, aliases, or Git hooks that arrive with a cloned project. Keep a strict allowlist so only commands you have approved can run on your machine.
2. Give your agent a real boundary.
Clone and experiment inside a disposable container with no access to your credentials or cloud keys. These flaws fire outside the sandbox, so your agent needs isolation around its whole environment, not a polite suggestion to behave.
3. Review AI output with an attacker's eyes.
Treat every generated change like code that arrived from a stranger. Our guide to code review when humans review AI output instead of human output walks through the discipline that keeps assistants helpful instead of dangerous.
Yesterday we vetted the code and trusted the tool.
Today the tool can run untrusted commands before any code reaches your editor.
If this made you wonder how well you actually understand agent tooling, measure yourself instead of guessing. Take the five minute LLM agents and tooling skill check on BatchBrain and get a public, verifiable receipt of your competence.
Have you caught an agent trying to run something it should not have? What guardrails does your team use to keep AI coding assistants from executing untrusted commands?
Sources: The Hacker News on malicious Git configs that make AI agents run attacker code, The Hacker News on Aurora ransomware operators using Cursor AI, and The Hacker News on the Shai-Hulud credential stealer expanding into AI tool configs.