Malicious .git configs can make Claude, Codex, Cursor run attacker code

Manifold Security disclosed eight flaws across seven CLI AI coding agents where a repo's Git config names a command the agent runs as the user, outside the sandbox. Fixes shipped for goose, Claude Code, and Cursor; Hermes Agent, Qwen Code, Grok Build, and a second Claude Code path remained unpatched as of Sept 1.