DeepSeek-Reasonix: How a poisoned config can hijack an AI coding agent

This post details a critical command execution vulnerability (ConfigPoisoning) found in DeepSeek-Reasonix Studio, a desktop git client for AI-assisted development. The vulnerability arises from how the tool processes repository-specific git configuration files (`.git/config` and `.gitattributes`), allowing attacker-controlled commands to execute when a developer views a file's diff. The root cause is identified as the failure to neutralize the `filter.<driver>.clean` git config key, which is selected per file via `.gitattributes` and not covered by existing hardening mechanisms. The post provides a detailed breakdown of the vulnerability's mechanism, its scope, and recommendations for users and tool builders, including updating DeepSeek-Reasonix, overriding relevant git keys on every call, and testing against hostile configurations. It also highlights that this pattern of trusting repository configuration as tool settings is present in other agentic tools and discusses how GitLab's Threat Research Group can help identify similar vulnerabilities.