Manifold Security: Single Flaw Lets Untrusted Repos Execute Code in Claude Code, Codex, Cursor, and Grok
agents claude cursor grok
| Source: Mastodon | Original article
A vulnerability dubbed GitSpawn lets untrusted Git repositories execute code via AI coding agents such as Claude, Codex, Cursor, and Grok.
A security team at Manifold Security has uncovered a new class of supply‑chain flaws it calls **GitSpawn**, which lets a malicious Git repository execute code on a developer’s machine the instant it is opened with a popular AI‑assisted coding assistant. The researchers found that several widely used CLI agents – including Claude Code, Codex, Cursor and Grok – automatically run Git commands during startup. If the repository a user receives contains a crafted .git folder, the agent will process it without prompting for confirmation, potentially running attacker‑supplied scripts before the user has even logged in.
The issue matters because these agents are increasingly embedded in everyday development workflows, from local editors to cloud‑based IDEs. Manifold’s tests showed the vulnerability across a range of agents – Claude Code, Goose, Hermes Agent, Qwen Code and Grok Build – collectively accounting for close to half a million GitHub stars. Claude Code alone registers more than 77 million monthly npm downloads, underscoring the scale of exposure. Unlike traditional phishing attacks that rely on user clicks, GitSpawn can be triggered simply by opening a zipped folder, a shared drive, a synced directory or a USB stick that contains the poisoned repository, making it a potent vector for silent code injection.
What to watch next is how the vendors respond. Patches will need to alter the agents’ startup routines to validate or sandbox incoming .git metadata, and developers will likely be advised to verify repository provenance before invoking an AI assistant. The broader community may also revisit the security model of CLI‑based AI tools, prompting stricter defaults or optional consent steps. As the research circulates on platforms such as Hacker News, the pressure will mount for rapid mitigations to prevent GitSpawn from becoming a routine attack surface in the AI‑driven software supply chain.
Sources
Back to AIPULSEN