GitSpawn Flaws Let Malicious Repositories Execute Code in Claude Code, Codex, Cursor, and Grok

Cybersecuritynews •Guru Baran • September 2, 2026

A newly disclosed class of vulnerabilities, dubbed GitSpawn, allows a booby-trapped repository to silently execute code on a developer’s machine the moment it is opened with an AI coding agent, no prompt typed, no approval clicked, and in some cases before the user has even authenticated. Security researchers at Manifold Security found the flaw while […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

GitSpawn Vulnerabilities Allow Code Execution in AI Coding Agents A series of vulnerabilities, termed GitSpawn, have been disclosed affecting multiple AI coding agents, including Claude Code, Codex, and Cursor. These flaws allow malicious Git configurations to execute arbitrary code on a developer's machine without user interaction or approval. The vulnerabilities were identified by Manifold Security and affect agents that run Git commands in the background before user authentication or trust prompts. As of September 1, 2026, several of these vulnerabilities remain unpatched, particularly in Hermes Agent, Qwen Code, and Grok Build. The vulnerabilities are linked to improper handling of Git configurations, specifically the core.fsmonitor setting. Affected versions include Claude Code 2.1.193 and earlier, Codex CLI 0.102.0 to 0.130.0, and Goose 1.41.0. Patches have been released for some tools, but many remain vulnerable. The issue is critical due to the potential for full system compromise, including access to sensitive credentials. 10 sources 70

Extracted Entities

GitSpawn Flaws Let Malicious Repositories Execute Code in Claude Code, Codex, Cursor, and Grok

The full story

Extracted Entities

Campaigns (1)

Companies (1)

Tools (3)