Malicious .git configs can make AI coding agents run attacker code
Read original source →thehackernews.com
Manifold Security disclosed eight flaws across seven CLI AI coding agents where a repo's Git config names a command the agent runs as the user, outside the sandbox. Fixes shipped for goose, Claude Code, and Cursor; Hermes Agent, Qwen Code, Grok Build, and a second Claude Code path remained unpatched as of Sept 1.
2 sources
More stories today
Google's Gemini 4 Argon builds explorable 3D worlds in Antigravity
Google AI·58 minutes ago
Anthropic licenses Opaque Systems tech in acquihire deal
Opaque Systems announced a Tuesday agreement with Anthropic that licenses Opaque's confidential-computing technology and brings some of its staff aboard. The deal is Anthropic's latest acquihire, following a pattern of absorbing teams rather than whole companies.
The New Stack·1 hour ago
Sakana AI releases AI Scientist v3, the Agentic Scientist
David Ha (hardmaru)·1 hour agoSimons Foundation receives $5 million from OpenAI for math research
OpenAI·1 hour agoAkrites tackles flood of AI-generated open source bug reports
Maintainers are being inundated with AI-generated vulnerability reports that are inaccurate, as AI makes it easier to find potential flaws in open source software. Akrites aims to filter the noise, since finding something that looks like a vulnerability isn't the same as finding a genuine security flaw.
Nous Research ships REA plugin for Hermes Agent
Teknium·1 hour ago
ComfyUI user shares prompting trick for H3 video upscaling
A Reddit user reports that H3 ignored most of a multi-part prompt on a 2-second clip with 7 requested alterations, following only one or two points while color grading to a reference image.
r/ComfyUI·1 hour agoReddit debate asks whether downplaying AI is rational self-interest
A r/Singularity post steelmans the anti-AI side, arguing that if AI could automate a substantial portion of someone's job, downplaying its capabilities may be rational self-interest rather than genuine skepticism.
r/Singularity·1 hour ago
