GitSpawn Flaw Enables Arbitrary Code Execution in Claude Code, Codex, Cursor and Grok

Gbhackers •Divya • September 3, 2026

A newly disclosed vulnerability class, named GitSpawn, reveals a serious weakness in AI coding agents that automatically execute Git commands to understand a developer’s project better. Researchers at Manifold Security discovered that several tools, including Claude Code, OpenAI Codex, Cursor, Grok Build, Goose, Hermes Agent, and Qwen Code, might inadvertently run commands controlled by an […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

GitSpawn Vulnerabilities Allow Code Execution in AI Coding Agents A series of vulnerabilities, termed GitSpawn, have been disclosed affecting multiple AI coding agents, including Claude Code, Codex, and Cursor. These flaws allow malicious Git configurations to execute arbitrary code on a developer's machine without user interaction or approval. The vulnerabilities were identified by Manifold Security and affect agents that run Git commands in the background before user authentication or trust prompts. As of September 1, 2026, several of these vulnerabilities remain unpatched, particularly in Hermes Agent, Qwen Code, and Grok Build. The vulnerabilities are linked to improper handling of Git configurations, specifically the core.fsmonitor setting. Affected versions include Claude Code 2.1.193 and earlier, Codex CLI 0.102.0 to 0.130.0, and Goose 1.41.0. Patches have been released for some tools, but many remain vulnerable. The issue is critical due to the potential for full system compromise, including access to sensitive credentials. 8 sources 70

Extracted Entities

GitSpawn Flaw Enables Arbitrary Code Execution in Claude Code, Codex, Cursor and Grok

The full story

Extracted Entities

Campaigns (1)

Companies (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Tools (6)