Git identity spoof fools Claude into giving bad code the nod

Security researchers at Manifold Security demonstrated a vulnerability in Claude-powered code reviewers where attackers can spoof a trusted developer's Git identity to bypass automated approval workflows. By forging commit metadata (author name and email), malicious changes appear to originate from recognized maintainers, causing the AI system to approve them based on authorship rather than code quality. The finding highlights how AI code review systems can be misconfigured to trust author identity signals, creating a gap between claimed and verified identity.