Claude Code, Codex, Cursor, Grok Build, and other agents can execute arbitrary code as soon as a repository is opened, without any prompts being typed.
Researchers at Manifold Security have uncovered GitSpawn, a class of vulnerabilities affecting seven of the most widely used AI coding agents: Claude Code, OpenAI Codex, Cursor, Goose, Hermes Agent, Qwen Code, and Grok Build. Most of these agents run routine Git commands (such as git status) in the background to retrieve context about a project.
However, Git has a performance setting, core.fsmonitor, which allows a repository to designate an auxiliary program that is automatically launched each time the index is refreshed. A malicious repository can write an arbitrary command to it: as soon as an AI agent executes an innocuous Git command inside, this command is executed with the user's full rights, outside of any sandbox and invisible to permission systems. However, the attack requires that the booby-trapped repository, including the folder .git , be transmitted via an archive, a shared disk or a USB key rather than by a git clone traditional one.
Read the full article on the original source
Go to the source →