GitSpawn: Flaw Lets Untrusted Repos Run Code in Claude Code, Codex, Cursor, Grok (www.manifold.security)

A significant security vulnerability, dubbed "GitSpawn," has been identified in several AI coding agents, including Claude Code, Codex, and Cursor, allowing untrusted repositories to execute arbitrary code on users' machines without prompts. Researchers discovered that these agents run Git commands during context gathering—often before user authentication or workspace trust confirmation—without properly sanitizing the Git configuration files. This flaw can lead to severe security risks, including unauthorized access to SSH keys and cloud credentials. The implications for the AI/ML community are critical, as this vulnerability is not limited to a single vendor; it affects multiple widely used platforms, collectively serving millions of users and carrying significant GitHub popularity. While some versions of affected agents have been patched, several remain unaddressed, necessitating urgent action by developers to implement stringent sanitization protocols on Git configurations to protect users. This highlights the need for ongoing research and vigilance in the security of AI tools, as their growing integration into daily development workflows increases the stakes for potential exploitation.