A Single Flaw Lets Untrusted Repos Run Code in Claude Code, Codex, Cursor, Grok
1–9 of 9 posts
Re: A Single Flaw Lets Untrusted Repos Run Code in Claude Code, Codex, Cursor, Grok
#2tl;dr: The .git/config file can contain entries like core.fsmonitor which are hooks to run code under various circumstances when running Git. This is being sold, through reams of AI slop prose, as a serious security issue, because agents commonly invoke these sorts of Git commands at the start of the run without being explicitly asked.
But it isn't really, because cloning a Git repository doesn't copy .git/config (it's a local, per-developer file). So unless you're downloading and unpacking a tarball that contains a .git folder, or using rsync or something to copy the project (i.e. not actually using Git properly), you can really only pwn yourself this way.
And none of this is particularly new or interesting. In fact I can recall a story from months ago where someone prompted a not-quite-frontier model to probe Git for vulnerabilities, and it came back with a writeup of exactly this (as well as something similar for Vim). At the time people were amused because it's not a "real" vulnerability for Git, and it's therefore even less so for agents.
Also, there are ads inserted throughout for the services offered by the domain hosting the document.
Re: A Single Flaw Lets Untrusted Repos Run Code in Claude Code, Codex, Cursor, Grok
#3tl;dr: The .git/config file can contain entries like core.fsmonitor which are hooks to run code under various circumstances when running Git. This is being sold, through reams of AI slop prose, as a serious security issue, because agents commonly invoke these sorts of Git commands at the start of the run without being explicitly asked. But it isn't really , because cloning a Git repository doesn't copy .git/config (i…
If you download a zip file that contains the hidden .git folder, with the config file inside, and open it with an LLM, it can run an arbitrary program, if you ask it to or not. Even if it's not actually a git repository, as long as it has enough to trigger the hooks when you run "git status". That sounds like a massive problem to me
Re: A Single Flaw Lets Untrusted Repos Run Code in Claude Code, Codex, Cursor, Grok
#4tl;dr: The .git/config file can contain entries like core.fsmonitor which are hooks to run code under various circumstances when running Git. This is being sold, through reams of AI slop prose, as a serious security issue, because agents commonly invoke these sorts of Git commands at the start of the run without being explicitly asked. But it isn't really , because cloning a Git repository doesn't copy .git/config (i…
If you download a zip file that contains the hidden .git folder, with the config file inside, and open it with an LLM, it can run an arbitrary program, if you ask it to or not. Even if it's not actually a git repository, as long as it has enough to trigger the hooks when you run "git status". That sounds like a massive problem to me
Your threat model is that you give an untrusted .zip archive to an LLM, and it decides to unpack that, then decides to try using it like a git repository because the unpack produced a .git folder?
Yeah, I wouldn't have --dangerously-skip-permissions on for that. I mean, the archive might also contain attempts at prompt injection.
Re: A Single Flaw Lets Untrusted Repos Run Code in Claude Code, Codex, Cursor, Grok
#5Earlier quoted context omitted.
If you download a zip file that contains the hidden .git folder, with the config file inside, and open it with an LLM, it can run an arbitrary program, if you ask it to or not. Even if it's not actually a git repository, as long as it has enough to trigger the hooks when you run "git status". That sounds like a massive problem to me
Your threat model is that you give an untrusted .zip archive to an LLM, and it decides to unpack that, then decides to try using it like a git repository because the unpack produced a .git folder? Yeah, I wouldn't have --dangerously-skip-permissions on for that. I mean, the archive might also contain attempts at prompt injection.
Doesn't require a permissions bypass or a prompt, that's the point. Every agent here ships a workspace trust prompt but the payload fires before it's shown. `--dangerously-skip-permissions` is therefore irrelevant as the permission system never got consulted.
Delivery isn't self-inflicted either. A colleague sends you a zip or a client hands over a codebase. Inspecting `.git/config` before opening a shared project isn't standard practice. Pointing an agent at a project you were sent is what agents are for and exactly why these tools ship a workspace trust prompt. The issue here is that it fires too late.
Re: A Single Flaw Lets Untrusted Repos Run Code in Claude Code, Codex, Cursor, Grok
#6Earlier quoted context omitted.
If you download a zip file that contains the hidden .git folder, with the config file inside, and open it with an LLM, it can run an arbitrary program, if you ask it to or not. Even if it's not actually a git repository, as long as it has enough to trigger the hooks when you run "git status". That sounds like a massive problem to me
Your threat model is that you give an untrusted .zip archive to an LLM, and it decides to unpack that, then decides to try using it like a git repository because the unpack produced a .git folder? Yeah, I wouldn't have --dangerously-skip-permissions on for that. I mean, the archive might also contain attempts at prompt injection.
You get a folder from someone else. You open your LLM of choice in that folder. You are pwned
Re: A Single Flaw Lets Untrusted Repos Run Code in Claude Code, Codex, Cursor, Grok
#7[dead]
Re: A Single Flaw Lets Untrusted Repos Run Code in Claude Code, Codex, Cursor, Grok
#8Earlier quoted context omitted.
Your threat model is that you give an untrusted .zip archive to an LLM, and it decides to unpack that, then decides to try using it like a git repository because the unpack produced a .git folder? Yeah, I wouldn't have --dangerously-skip-permissions on for that. I mean, the archive might also contain attempts at prompt injection.
You get a folder from someone else. You open your LLM of choice in that folder. You are pwned
Who (1) uses git and (2) passes around folders like that?
This is a PEBKAC thing more than a security issue
Re: A Single Flaw Lets Untrusted Repos Run Code in Claude Code, Codex, Cursor, Grok
#9Earlier quoted context omitted.
You get a folder from someone else. You open your LLM of choice in that folder. You are pwned
Who (1) uses git and (2) passes around folders like that? This is a PEBKAC thing more than a security issue
Using git is not a requirement here. You just need enough of a git folder for a "git status" to trigger running a program, and the "git status" is run automatically by an agent, without you asking it to. You could open any innocuous folder that you have been sent by someone else, and the agent would run the program. At my job, we send clients a folder containing the completed project. If someone was to put in a .git folder with the config option set, not even a full repository, and the client opened it with an agent, then we could have made the client run any command we wanted