You Opened a Repo. Your AI Agent Ran the Attacker’s Command #Shorts

Posted By on October 10, 2026

On September first, Manifold Security published GitSpawn: eight findings across seven AI coding agents.
Part one, the README hijack Short: https://youtube.com/shorts/gQL09XVAsGE
Full deep dive, the repo-trust fix: https://youtu.be/SzIva8TGi3E

SOURCES
• GitSpawn research (Manifold Security, 1 Sep 2026): https://www.manifold.security/blog/ai-coding-agents-git-hijack
• GitSpawn coverage (The Hacker News): https://thehackernews.com/2026/09/malicious-git-configs-can-make-claude.html
• goose advisory, CVE-2026-72718, fixed in 1.44.0: https://github.com/aaif-goose/goose/security/advisories/GHSA-r5pp-p5r8-466r
• Hermes Agent fix (PR 101483, release 0.21.1): https://github.com/NousResearch/hermes-agent/pull/101483
• Hermes Agent follow-up fix (release 0.21.6, PR 130661): https://github.com/NousResearch/hermes-agent/releases/tag/v0.21.6
• Qwen Code 0.23.4 release notes (fix PR 11669): https://github.com/QwenLM/qwen-code/releases/tag/v0.23.4
• Claude Code changelog: https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md
• tensorlake compromise (Socket): https://socket.dev/blog/tensorlake-compromise
• tensorlake worm analysis (StepSecurity): https://www.stepsecurity.io/blog/tensorlake-npm-compromised-hostage-token-worm
• tensorlake compromise (Aikido): https://www.aikido.dev/blog/tensorlake-npm-package-compromised
• GitHub malware advisory for tensorlake: https://github.com/advisories/GHSA-rqxj-g25x-4v9v
• dforge-mcp loader with valid provenance (Orca Security): https://orca.security/resources/research/ghappier-loader-npm-supply-chain-attack/
• Mandiant case via The Hacker News: https://thehackernews.com/2026/09/attacker-hijacks-ai-coding-assistant.html
• git config docs (precedence, core.fsmonitor): https://git-scm.com/docs/git-config
• Claude Code docs: permissions: https://code.claude.com/docs/en/permissions
• Claude Code docs: hooks: https://code.claude.com/docs/en/hooks
• Claude Code docs: settings: https://code.claude.com/docs/en/settings
• npm ci: https://docs.npmjs.com/cli/v12/commands/npm-ci
• npm config (ignore-scripts, min-release-age): https://docs.npmjs.com/cli/v12/using-npm/config
• npm approve-scripts (npm 12): https://docs.npmjs.com/cli/v12/commands/npm-approve-scripts
• npm provenance: https://docs.npmjs.com/generating-provenance-statements
• npm access tokens: https://docs.npmjs.com/about-access-tokens
• npm trusted publishing: https://docs.npmjs.com/trusted-publishers

DISCLOSURES
• Simulation for education: the domain (evil.example) is fake and the payload shown is non-functional.
• Visuals are simulations; payloads are redacted and non-functional.
• Reported, not tested by us: the tensorlake token-revoke wipe described by Socket, StepSecurity and Aikido.

Framework mapping:
OWASP LLM Top 10 2026: LLM04: 2026 Supply Chain, LLM03: 2026 Excessive Agency – https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/
OWASP Agentic Top 10 2026: ASI04 Agentic Supply Chain Vulnerabilities, ASI05 Unexpected Code Execution (RCE) – https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/
MITRE ATLAS: AML.T0010.001 AI Supply Chain Compromise: AI Software, AML.T0081 Modify AI Agent Configuration, AML.T0055 Unsecured Credentials – https://atlas.mitre.org/
MITRE ATLAS mitigations: AML.M0032 Segmentation of AI Agent Components, AML.M0029 Human In-the-Loop for AI Agent Actions

#Shorts #AIsecurity #AIagents #SupplyChainSecurity