RuntimeAI Reports 16 AI Security Incidents Including Malicious Git Configs Hijacking Claude Code and 6 AI Agents

Executive Summary

RuntimeAI's weekly AI security incident report for September 4, 2026 covers 16 AI-related security incidents, with particular relevance to attacks against coding agents, AI infrastructure, MCP-style integrations, and AI supply-chain components.

The report highlights that attackers are increasingly targeting the systems surrounding autonomous agents rather than the agents themselves.

Key Incidents

Malicious Git Configs Hijack AI Agents

The headline incident involves malicious .git configuration files that hijacked Claude Code and six other AI coding agents, demonstrating how agent-adjacent infrastructure can be weaponized.

Attacks on AI Infrastructure

Multiple incidents targeted AI infrastructure components, including model hosting, API endpoints, and orchestration layers.

MCP-Style Integration Attacks

Attacks targeting MCP (Model Context Protocol) style integrations show that the connective tissue between agents and tools is a growing attack surface.

AI Supply Chain Targeting

AI supply-chain components, including dependencies and plugins used by autonomous agents, are increasingly targeted by attackers.

Implications

• The ecosystem surrounding AI agents is as important as the agents themselves.
• Coding agents, MCP integrations, and supply-chain components need security scrutiny.
• Weekly tracking of AI security incidents is essential for threat awareness.

Sources

• RuntimeAI, 4 Sep 2026

Defensive research only. No exploit code or attack instructions.