AI Coding Agents Found Vulnerable to Configuration Injection via Malicious Repos

Security research published by Manifold Security in September 2026 identified configuration injection vulnerabilities in several AI coding agents, including Claude Code, Codex, Goose, Qwen Code, and Grok Build, with CVEs rated between CVSS 7.0 and 7.3. The flaw allows a crafted repository — such as one delivered via a pull request or cloned dependency — to manipulate agent configuration files and trigger attacker-controlled commands on the developer's machine. Because these agents typically run with access to credentials spanning source control, cloud environments, and CI systems, a successful exploit can compromise far more than a single workstation. The vulnerability chain works through implicit trust: the developer trusts the agent, the agent trusts the repository, and the repository is attacker-controlled with no validation at any step. Security researchers recommend treating repository configuration as untrusted input, requiring human confirmation before agents execute commands, and running agents with scoped, minimal credentials.