Anthropic's Claude Code has been shown to approve malicious changes when attackers spoof a trusted maintainer's Git identity, underlining how easily automated review systems can be misled when they treat metadata as proof of trust.

In a demonstration described by Manifold Security, a fake author name and email set in Git were enough to make a commit look as though it came from a respected contributor. The code was then passed through an AI review flow that accepted it, even though the apparent authorship was fabricated. The firm argued that the weakness is not in Git itself, but in the assumption that commit metadata says anything reliable about who actually wrote the code.

That distinction matters because trust-based automation is already common in open-source workflows. Manifold said the logic is understandable: maintainers are overwhelmed, so systems that fast-track well-known contributors can save time. But the same approach becomes risky when identity checks are reduced to org membership, contribution history or a maintainer list, none of which proves authorship. The company compared the issue with recent supply-chain compromises in which malicious code was treated as legitimate long enough to do damage.

The concern also lands against a wider backdrop of security problems in Anthropic's code tooling. GitLab has flagged CVE-2025-59041, in which malicious Git email settings could lead to arbitrary code execution before a workspace-trust prompt appears, while SentinelOne has documented later flaws that could bypass trust dialogs or leak information from attacker-controlled repositories. Separately, The Atlantic reported this week that Anthropic is simultaneously promoting a far more powerful cybersecurity model, Claude Mythos Preview, which the company says is capable of autonomous exploitation work but is being kept from public release because of the risks.

Taken together, the episodes point to the same lesson: identity cues and repository settings should not be treated as security controls. Manifold's conclusion was blunt: if the only thing standing between a bad change and a merge is the model's impression of who sent it, the system is too trusting for its own good.

Source Reference Map

Inspired by headline at: [1]

Sources by paragraph:

Source: Noah Wire Services