GitSpawn Flaws Let Malicious Repositories Execute Code in Claude Code, Codex, Cursor, and Grok
Brief
A newly disclosed class of vulnerabilities, dubbed GitSpawn, allows a booby-trapped repository to silently execute code on a developer’s machine the moment it is opened with an AI coding agent, no prompt typed, no approval clicked, and in some cases before the user has even authenticated.
Security researchers at Manifold Security found the flaw while investigating what CLI-based coding agents actually do on startup, as detailed in the technical disclosure published by Manifold Security.
Nearly every agent they examined gathers project context by quietly running git commands like git status or git diff in the background. That behavior is unremarkable on its own, but each of these commands triggers git to refresh its internal index, and that refresh is where the danger lies.
Git supports a performance setting called core.