AI Coding Agents Can Execute Malicious Code Just by Reading an Untrusted Repo

Popular AI coding agents — including Claude Code, Cursor, Codex, and others — are vulnerable to code execution attacks triggered simply by opening or cloning an untrusted repository. The attack exploits a known Git mechanism where operations like 'git status' can silently invoke attacker-controlled commands via hooks or config settings such as core.fsmonitor. What makes this newly dangerous is that AI agents automate the act of running these Git commands without user input, effectively removing the human judgment that previously served as a safeguard. The agents' built-in permission systems and sandbox guardrails never register a threat because the malicious execution is triggered by Git itself, not by the agent's own command decisions. Security experts warn that treating any unverified repository as potentially hostile is now essential, and that the common workflow of pointing an AI agent at an unfamiliar codebase carries real code-execution risk.