Your AI Coding Agent Will Run Whatever a Stranger's Repo Tells It To

AI coding agents have been running shell commands based on what a stranger's repository tells them to, according to recent findings. This flaw, which stems from the way these agents interact with git repositories, has far-reaching implications. Traditionally, opening a folder and letting a coding agent explore the codebase was considered safe, but the new reality is that doing so can now grant attackers a shell without any prompt, approval, or sandbox.

Security teams should be aware that AI coding agents have inherited the entire attack surface of git, even if they don't inherit the caution that developers typically exercise when cloning random repositories. The vulnerability arises because the agent's safety mechanisms fail to detect the shell command execution triggered by a seemingly innocent git operation.

This issue affects popular AI coding agents like Claude Code, Codex, Cursor, Grok, Goose, Hermes, and Qwen Code, all of which independently opted to run git commands for context. The flaw is particularly problematic because it bypasses the safety features touted by vendors, like permission systems and sandboxing. To mitigate the risk, developers should treat any repository they didn't create as potentially hostile and refrain from allowing AI agents to explore unfamiliar codebases without proper scrutiny.

The industry may need to reconsider the standard practice of using AI agents to shell out to real dev tools for context, as this could create additional silent execution paths in various CLIs.