{"id":3898,"date":"2026-09-02T16:42:30","date_gmt":"2026-09-02T16:42:30","guid":{"rendered":"https:\/\/i10xnews.kinsta.cloud\/autonomous-ai-agents-malicious-code-poisoned-git-repositories"},"modified":"2026-09-02T16:42:30","modified_gmt":"2026-09-02T16:42:30","slug":"autonomous-ai-agents-malicious-code-poisoned-git-repositories","status":"publish","type":"post","link":"https:\/\/i10x.ai\/news\/autonomous-ai-agents-malicious-code-poisoned-git-repositories","title":{"rendered":"AI Agents Run Malicious Code from Poisoned Git Repositories"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Autonomous AI Agents Can Execute Malicious Code via Poisoned Git Repositories<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Summary<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A new report from Google AI reveals that autonomous AI agents can unwittingly execute malicious code when operating inside tampered Git repositories.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What happened<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Researchers discovered that when AI agents powered by models like Claude, Qwen, and Grok are initialized within a poisoned codebase, they automatically trigger disguised installation scripts or malicious build commands without requiring further user prompting.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Why it matters now<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The AI industry is rapidly shifting from passive chatbots to active agents equipped with CLI access and autonomous execution capabilities. This vulnerability transforms standard software supply-chain risks into automated <strong>RCE<\/strong> threats, threatening the deployment of agentic coding assistants.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Who is most affected<\/h3>\n\n\n<ul class=\"wp-block-list\"><li>Software engineers adopting AI coding agents<\/li><li>Enterprise DevSecOps teams<\/li><li>AI infrastructure builders designing autonomous environments<\/li><\/ul>\n\n\n<h3 class=\"wp-block-heading\">The under-reported angle<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">This is not a classic LLM prompt injection vulnerability; it is a fundamental failure in <strong>zero-trust<\/strong> architecture. Agents are being granted local execution permissions without native policy guardrails, meaning the danger lies in the runtime infrastructure, not the neural network itself.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Deep Dive<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Have you ever stopped to consider what happens when we hand an AI model the keys to a developer&#8217;s terminal? The pivot from conversational LLMs to autonomous AI agents marks a critical inflection point in intelligence infrastructure. We are giving models &#8220;hands&#8221; in the form of shell access and API integrations. Yet a new disclosure from Google AI highlights the architectural fragility of this shift: agents powered by top-tier models like Claude, Qwen, and Grok can be easily manipulated into executing malware just by waking up in the wrong neighborhood.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The attack vector is deceptively simple and leverages standard developer workflows. Threat actors tamper with a Git repository by burying malicious commands in initialization files, package manager scripts, or hidden submodules. When a user asks an AI agent to analyze, summarize, or debug the cloned repository, the agent&#8217;s default behavior is often to initialize the project to understand its state. In doing so, it automatically runs the poisoned scripts\u2014effectively acting as an automated execution engine for the attacker.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Current media coverage often frames this as an &#8220;AI risk,&#8221; but it is more accurately an infrastructure and permissions failure. The models are not being &#8220;hacked&#8221;; they are simply doing their jobs too efficiently within unconstrained environments. When an agent lacks context distinguishing a vetted internal repository from an untrusted public fork, its helpfulness becomes a weapon. This dynamic highlights a severe gap in how developer tools currently handle agent permissions.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To safely scale the &#8220;Agentic Web,&#8221; the AI ecosystem must urgently adopt defense-in-depth strategies that look beyond prompt filtering. Security architectures must treat AI agents as untrusted foreign processes. This means shifting toward zero-trust command execution, where agents operate exclusively within ephemeral, strictly firewalled sandboxes (using tools like Docker or Firejail). Furthermore, the industry is missing robust policy engines (like OPA or CEL) natively integrated into agent runtimes that can enforce allow\/deny lists for specific CLI commands.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This vulnerability forces a reckoning in AI tooling. The current default\u2014giving an agent open-ended access to a developer&#8217;s local machine\u2014is unsustainable for enterprise adoption. Moving forward, <strong>Human-in-the-loop<\/strong> (HITL) approval for destructive or state-changing commands cannot be an optional toggle; it must be a foundational primitive in agent workflow design, alongside cryptographic provenance for the repositories these models interact with.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Stakeholders &amp; Impact<\/h3>\n\n\n<ul class=\"wp-block-list\"><li>AI Model \/ Agent Vendors \u2014 Impact: High \u2014 Insight: Must rethink default configurations; agents need native dry-run capabilities and secure-by-default execution boundaries.<\/li><li>Enterprise SecOps \u2014 Impact: High \u2014 Insight: Forces the rapid creation of new MDM policies, EDR rules, and network egress controls specifically tailored for AI agent behaviors.<\/li><li>Developers &amp; Engineers \u2014 Impact: Medium \u2014 Insight: Friction will increase. Engineers will need to adapt to strict HITL approvals and isolated container environments for AI assistants.<\/li><li>Infrastructure Tooling \u2014 Impact: Significant \u2014 Insight: Massive market opportunity for vendors building &#8220;secure AI sandboxes,&#8221; policy engines, and execution guardrails.<\/li><\/ul>\n\n\n<h3 class=\"wp-block-heading\">About the analysis<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">This independent analysis synthesizes findings from recent Google AI security reports and maps them against broader AI industry threat vectors. It is designed to equip DevSecOps leaders, CTOs, and AI infrastructure architects with the context needed to safely deploy agentic workflows in production environments.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">i10x Perspective<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The transition from AI as an &#8220;advisor&#8221; to AI as an &#8220;actor&#8221; is breaking our legacy security models. If we cannot trust an agent to safely clone and analyze a repository without risking host compromise, the economic promise of autonomous software engineering stalls. Over the next three years, expect the AI infrastructure race to pivot heavily toward secure execution: the winners won&#8217;t just be the companies building the smartest models, but those building the most hardened, verifiable, and policy-driven agent runtimes. This is the birth of the <strong>AI-native zero-trust ecosystem<\/strong>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>New research shows autonomous AI agents like Claude and Grok can execute malware in tampered Git repos. Learn why zero-trust architecture is essential for safe agent deployment. Explore the guide.<\/p>\n","protected":false},"author":2,"featured_media":3895,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"paper_title":"","paper_url":"","pdf_url":"","doi":"","arxiv_id":"","authors":"","institutions":"","paper_date":"","venue":"","peer_reviewed":false,"code_url":"","data_url":"","funding_coi":"","figure_license":"","paper_license":"","replication":"","study_models":"","study_sample":"","footnotes":"","_yoast_wpseo_primary_category":""},"categories":[14,3,24,26,12,28,25],"tags":[],"companies":[39,40],"products":[51,48],"class_list":["post-3898","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-agents","category-anthropic","category-claude","category-grok","category-policy-safety","category-security-defense","category-x-ai","company-anthropic","company-x-ai","product-claude","product-grok"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>AI Agents Run Malicious Code from Poisoned Git Repositories - i10X News<\/title>\n<meta name=\"description\" content=\"AI agents can run malicious code from poisoned Git repos. Learn about this vulnerability and the need for zero-trust architecture for safe AI deployment.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/i10x.ai\/news\/autonomous-ai-agents-malicious-code-poisoned-git-repositories\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"AI Agents Run Malicious Code from Poisoned Git Repositories - i10X News\" \/>\n<meta property=\"og:description\" content=\"AI agents can run malicious code from poisoned Git repos. Learn about this vulnerability and the need for zero-trust architecture for safe AI deployment.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/i10x.ai\/news\/autonomous-ai-agents-malicious-code-poisoned-git-repositories\" \/>\n<meta property=\"og:site_name\" content=\"i10X News\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-02T16:42:30+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/ai-agents-poisoned-git-repositories.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1344\" \/>\n\t<meta property=\"og:image:height\" content=\"768\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Christopher Ort\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:site\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Christopher Ort\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"NewsArticle\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/autonomous-ai-agents-malicious-code-poisoned-git-repositories#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/autonomous-ai-agents-malicious-code-poisoned-git-repositories\"},\"author\":{\"name\":\"Christopher Ort\",\"@id\":\"https:\\\/\\\/news.i10x.ai\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\"},\"headline\":\"AI Agents Run Malicious Code from Poisoned Git Repositories\",\"datePublished\":\"2026-09-02T16:42:30+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/autonomous-ai-agents-malicious-code-poisoned-git-repositories\"},\"wordCount\":802,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/news.i10x.ai\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/autonomous-ai-agents-malicious-code-poisoned-git-repositories#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/ai-agents-poisoned-git-repositories.webp\",\"articleSection\":[\"Agents\",\"Anthropic\",\"Claude\",\"Grok\",\"Policy &amp; Safety\",\"Security &amp; Defense\",\"xAi\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/i10x.ai\\\/news\\\/autonomous-ai-agents-malicious-code-poisoned-git-repositories#respond\"]}],\"dateModified\":\"2026-09-02T16:42:30+00:00\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/autonomous-ai-agents-malicious-code-poisoned-git-repositories\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/autonomous-ai-agents-malicious-code-poisoned-git-repositories\",\"name\":\"AI Agents Run Malicious Code from Poisoned Git Repositories - i10X News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/news.i10x.ai\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/autonomous-ai-agents-malicious-code-poisoned-git-repositories#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/autonomous-ai-agents-malicious-code-poisoned-git-repositories#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/ai-agents-poisoned-git-repositories.webp\",\"datePublished\":\"2026-09-02T16:42:30+00:00\",\"description\":\"AI agents can run malicious code from poisoned Git repos. Learn about this vulnerability and the need for zero-trust architecture for safe AI deployment.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/autonomous-ai-agents-malicious-code-poisoned-git-repositories#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/i10x.ai\\\/news\\\/autonomous-ai-agents-malicious-code-poisoned-git-repositories\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/autonomous-ai-agents-malicious-code-poisoned-git-repositories#primaryimage\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/ai-agents-poisoned-git-repositories.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/ai-agents-poisoned-git-repositories.webp\",\"width\":1344,\"height\":768,\"caption\":\"Abstract illustration of AI security risks with a glowing AI sphere, broken server stacks, and digital locks, representing autonomous agents executing malicious code.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/autonomous-ai-agents-malicious-code-poisoned-git-repositories#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/news.i10x.ai\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"AI Agents Run Malicious Code from Poisoned Git Repositories\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/news.i10x.ai\\\/#website\",\"url\":\"https:\\\/\\\/news.i10x.ai\\\/\",\"name\":\"i10X News\",\"description\":\"Stay updated with the latest news and announcements from i10X.\",\"publisher\":{\"@id\":\"https:\\\/\\\/news.i10x.ai\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/news.i10x.ai\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/news.i10x.ai\\\/#organization\",\"name\":\"i10X\",\"url\":\"https:\\\/\\\/news.i10x.ai\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/news.i10x.ai\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"contentUrl\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"width\":180,\"height\":180,\"caption\":\"i10X\"},\"image\":{\"@id\":\"https:\\\/\\\/news.i10x.ai\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/i10x_ai\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/i10x-ai\",\"https:\\\/\\\/instagram.com\\\/i10x.ai\",\"https:\\\/\\\/www.youtube.com\\\/@i10X_ai_official\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/news.i10x.ai\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\",\"name\":\"Christopher Ort\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"caption\":\"Christopher Ort\"},\"description\":\"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/author\\\/christopher-ort\",\"sameAs\":[\"https:\\\/\\\/i10x.ai\\\/blog\\\/author\\\/christopher-ort\"],\"worksFor\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"alumniOf\":{\"@type\":\"EducationalOrganization\",\"name\":\"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)\",\"url\":\"https:\\\/\\\/www.fau.eu\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"AI Agents Run Malicious Code from Poisoned Git Repositories - i10X News","description":"AI agents can run malicious code from poisoned Git repos. Learn about this vulnerability and the need for zero-trust architecture for safe AI deployment.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/i10x.ai\/news\/autonomous-ai-agents-malicious-code-poisoned-git-repositories","og_locale":"en_US","og_type":"article","og_title":"AI Agents Run Malicious Code from Poisoned Git Repositories - i10X News","og_description":"AI agents can run malicious code from poisoned Git repos. Learn about this vulnerability and the need for zero-trust architecture for safe AI deployment.","og_url":"https:\/\/i10x.ai\/news\/autonomous-ai-agents-malicious-code-poisoned-git-repositories","og_site_name":"i10X News","article_published_time":"2026-09-02T16:42:30+00:00","og_image":[{"width":1344,"height":768,"url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/ai-agents-poisoned-git-repositories.webp","type":"image\/webp"}],"author":"Christopher Ort","twitter_card":"summary_large_image","twitter_creator":"@i10x_ai","twitter_site":"@i10x_ai","twitter_misc":{"Written by":"Christopher Ort","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/i10x.ai\/news\/autonomous-ai-agents-malicious-code-poisoned-git-repositories#article","isPartOf":{"@id":"https:\/\/i10x.ai\/news\/autonomous-ai-agents-malicious-code-poisoned-git-repositories"},"author":{"name":"Christopher Ort","@id":"https:\/\/news.i10x.ai\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a"},"headline":"AI Agents Run Malicious Code from Poisoned Git Repositories","datePublished":"2026-09-02T16:42:30+00:00","mainEntityOfPage":{"@id":"https:\/\/i10x.ai\/news\/autonomous-ai-agents-malicious-code-poisoned-git-repositories"},"wordCount":802,"commentCount":0,"publisher":{"@id":"https:\/\/news.i10x.ai\/#organization"},"image":{"@id":"https:\/\/i10x.ai\/news\/autonomous-ai-agents-malicious-code-poisoned-git-repositories#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/ai-agents-poisoned-git-repositories.webp","articleSection":["Agents","Anthropic","Claude","Grok","Policy &amp; Safety","Security &amp; Defense","xAi"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/i10x.ai\/news\/autonomous-ai-agents-malicious-code-poisoned-git-repositories#respond"]}],"dateModified":"2026-09-02T16:42:30+00:00"},{"@type":"WebPage","@id":"https:\/\/i10x.ai\/news\/autonomous-ai-agents-malicious-code-poisoned-git-repositories","url":"https:\/\/i10x.ai\/news\/autonomous-ai-agents-malicious-code-poisoned-git-repositories","name":"AI Agents Run Malicious Code from Poisoned Git Repositories - i10X News","isPartOf":{"@id":"https:\/\/news.i10x.ai\/#website"},"primaryImageOfPage":{"@id":"https:\/\/i10x.ai\/news\/autonomous-ai-agents-malicious-code-poisoned-git-repositories#primaryimage"},"image":{"@id":"https:\/\/i10x.ai\/news\/autonomous-ai-agents-malicious-code-poisoned-git-repositories#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/ai-agents-poisoned-git-repositories.webp","datePublished":"2026-09-02T16:42:30+00:00","description":"AI agents can run malicious code from poisoned Git repos. Learn about this vulnerability and the need for zero-trust architecture for safe AI deployment.","breadcrumb":{"@id":"https:\/\/i10x.ai\/news\/autonomous-ai-agents-malicious-code-poisoned-git-repositories#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/i10x.ai\/news\/autonomous-ai-agents-malicious-code-poisoned-git-repositories"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/autonomous-ai-agents-malicious-code-poisoned-git-repositories#primaryimage","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/ai-agents-poisoned-git-repositories.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/ai-agents-poisoned-git-repositories.webp","width":1344,"height":768,"caption":"Abstract illustration of AI security risks with a glowing AI sphere, broken server stacks, and digital locks, representing autonomous agents executing malicious code."},{"@type":"BreadcrumbList","@id":"https:\/\/i10x.ai\/news\/autonomous-ai-agents-malicious-code-poisoned-git-repositories#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/news.i10x.ai\/"},{"@type":"ListItem","position":2,"name":"AI Agents Run Malicious Code from Poisoned Git Repositories"}]},{"@type":"WebSite","@id":"https:\/\/news.i10x.ai\/#website","url":"https:\/\/news.i10x.ai\/","name":"i10X News","description":"Stay updated with the latest news and announcements from i10X.","publisher":{"@id":"https:\/\/news.i10x.ai\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/news.i10x.ai\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/news.i10x.ai\/#organization","name":"i10X","url":"https:\/\/news.i10x.ai\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/news.i10x.ai\/#\/schema\/logo\/image\/","url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","contentUrl":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","width":180,"height":180,"caption":"i10X"},"image":{"@id":"https:\/\/news.i10x.ai\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/i10x_ai","https:\/\/www.linkedin.com\/company\/i10x-ai","https:\/\/instagram.com\/i10x.ai","https:\/\/www.youtube.com\/@i10X_ai_official"]},{"@type":"Person","@id":"https:\/\/news.i10x.ai\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a","name":"Christopher Ort","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","caption":"Christopher Ort"},"description":"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.","url":"https:\/\/i10x.ai\/news\/author\/christopher-ort","sameAs":["https:\/\/i10x.ai\/blog\/author\/christopher-ort"],"worksFor":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"alumniOf":{"@type":"EducationalOrganization","name":"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)","url":"https:\/\/www.fau.eu"}}]}},"_links":{"self":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/3898","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/comments?post=3898"}],"version-history":[{"count":1,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/3898\/revisions"}],"predecessor-version":[{"id":5641,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/3898\/revisions\/5641"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media\/3895"}],"wp:attachment":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media?parent=3898"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/categories?post=3898"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/tags?post=3898"},{"taxonomy":"company","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/companies?post=3898"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/products?post=3898"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}