{"id":535251,"date":"2026-04-17T03:02:16","date_gmt":"2026-04-17T03:02:16","guid":{"rendered":"https:\/\/www.newsbeep.com\/uk\/535251\/"},"modified":"2026-04-17T03:02:16","modified_gmt":"2026-04-17T03:02:16","slug":"git-identity-spoof-fools-claude-into-giving-bad-code-the-nod-the-register","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/uk\/535251\/","title":{"rendered":"Git identity spoof fools Claude into giving bad code the nod \u2022 The Register"},"content":{"rendered":"<p>Security boffins say Anthropic&#8217;s Claude can be tricked into approving malicious code with just two Git commands by spoofing a trusted developer&#8217;s identity.<\/p>\n<p>In a blog published this week, Manifold Security <a target=\"_blank\" href=\"https:\/\/www.manifold.security\/blog\/spoofed-git-identity-ai-code-reviewer\" rel=\"nofollow noopener\">showed<\/a> how an AI-powered code reviewer built on Claude accepted changes that appeared to come from a legitimate maintainer. By setting a fake author name and email in Git, the team made a commit appear to originate from a trusted source, then passed it through an automated review flow where the model approved it.<\/p>\n<p>This is not a Git vulnerability \u2013 commit metadata has always been relatively easy to fake unless additional controls like signing are enforced. The problem arises when that metadata is treated as a signal of trust. In this case, the model appeared to give weight to the author&#8217;s claimed identity rather than independently assessing whether the change itself was sound.<\/p>\n<p>In Manifold&#8217;s test, the workflow was set to auto-approve pull requests from &#8220;recognized industry legends,&#8221; so the trust rule was obvious. In the real world, it&#8217;s usually less explicit \u2013 checks against org membership, past contributions, or a maintainer list \u2013 but it&#8217;s the same problem underneath. None of that proves who actually made the change.<\/p>\n<p>&#8220;The motivation behind such configurations is understandable. Maintainers of popular open source projects are drowning in PRs,&#8221; Manifold said. &#8220;Automating review for contributions from known, trusted figures reduces the bottleneck. But it creates an assumption that authorship can be trusted at face value.&#8221;<\/p>\n<p>Manifold compares the setup to the recent <a target=\"_blank\" href=\"https:\/\/www.theregister.com\/2026\/02\/20\/openclaw_snuck_into_cline_package\/\" rel=\"nofollow noopener\">OpenClaw Cline package compromise<\/a>, where a poisoned package slipped into a trusted environment and was treated as legitimate long enough to cause damage. In both cases, something that appeared to come from a reliable source was given a level of trust it hadn&#8217;t earned.<\/p>\n<p>What changes with systems like Claude is how that trust is applied. A human reviewer might question why a particular maintainer is making an unexpected change or take a closer look at the diff. An automated reviewer is more likely to follow its internal signals consistently, and if those signals include author identity, spoofing that identity becomes a way in.<\/p>\n<p>&#8220;Open source libraries are increasingly relying on AI-powered workflow tools to auto-review and approve pull requests, yet these agents are easily fooled, creating opportunities for threat actors to bypass security controls and poison popular code repositories,&#8221; Manifold warned.<\/p>\n<p>Manifold&#8217;s takeaway is that the guardrails can&#8217;t live in the model. If nothing else is checking who did what, bad code won&#8217;t just be suggested \u2013 it&#8217;ll get pushed. \u00ae<\/p>\n","protected":false},"excerpt":{"rendered":"Security boffins say Anthropic&#8217;s Claude can be tricked into approving malicious code with just two Git commands by&hellip;\n","protected":false},"author":2,"featured_media":535252,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20],"tags":[554,733,4308,86,56,54,55],"class_list":["post-535251","post","type-post","status-publish","format-standard","has-post-thumbnail","category-artificial-intelligence","tag-ai","tag-artificial-intelligence","tag-artificialintelligence","tag-technology","tag-uk","tag-united-kingdom","tag-unitedkingdom"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts\/535251","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/comments?post=535251"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts\/535251\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/media\/535252"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/media?parent=535251"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/categories?post=535251"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/tags?post=535251"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}