Ankura CTIX FLASH Update – September 8, 2026

Malware Activity

AI Coding Assistants and Trusted Developer Tools Become New Security Targets

Security researchers have identified a set of vulnerabilities affecting several AI coding assistants. Which includes Claude Code, Codex, Cursor, Hermes Agent, Qwen Code, and Grok Build. The malicious Git repository can secretly execute attacker-controlled commands on a developer’s machine. The issue is not with the AI models themselves, but with how some agents automatically process Git configuration settings stored in a repository’s hidden .git directory. If exploited, attackers could gain the same access as the user. Which would allow them to view, modify, or delete files without approval prompts. At the same time, cybersecurity experts are seeing a rise in malware campaigns that abuse the legitimate Node.js runtime (node.exe) to execute malicious JavaScript while appearing as trusted, digitally signed software. These attacks often begin with social engineering techniques such as