Reported by 2 outlets
GitSpawn Flaw Enables Arbitrary Code Execution in Claude Code, Codex, Cursor and Grok
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.60 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
GitSpawn Flaw Enables Arbitrary Code Execution in Claude Code, Codex, Cursor and Grok
gbhackers.com · 40d ago · September 3rd, 2026
A newly disclosed vulnerability class, named GitSpawn, reveals a serious weakness in AI coding agents that automatically execute Git commands to understand a developer’s project better. Researchers at Manifold Security discovered that several tools, including Claude Code, OpenAI Codex, Cursor, Grok Build, Goose, Hermes Agent, and Qwen Code, might inadvertently run commands controlled by an […] The post GitSpawn Flaw Enables Arbitrary Code Execution in Claude Code, Codex, Cursor and Grok appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
GitSpawn Flaws Let Malicious Repositories Execute Code in Claude Code, Codex, Cursor and Grok
cyberpress.org · 40d ago · September 3rd, 2026
A newly disclosed class of vulnerabilities, dubbed GitSpawn, can allow a booby-trapped software repository to silently execute code on a developer’s machine the moment it is opened with an AI coding agent. The attack requires no prompt, approval click, or other user interaction. In some cases, the malicious command can run before a developer has authenticated to the coding platform . Security researchers at Manifold Security discovered the issue while investigating what command-line AI coding agents automatically do when they start inside a project directory. GitSpawn Flaws Let Malicious Repositories Execute Code According to the Manifold Security technical disclosure, nearly every agent examined performs background Git commands, including git status and git diff , to collect project context before responding to a user. This behavior is ordinary and normally harmless, but it can trigger Git to refresh its internal index. The risk comes from Git’s core.fsmonitor setting. The configuration option is intended to improve performance by allowing a repository to define a file-system-monitor helper program. However, Git reads the core.fsmonitor value directly from the repository’s local .git/config file.