GitSpawn: A Single Flaw Lets Untrusted Repos Run Code in Claude Code

What happened

user GitSpawn: A Single Flaw Lets Untrusted Repos Run Code in Claude Code, and Others

How it works

Security researchers have uncovered a significant vulnerability named GitSpawn that allows untrusted repositories to execute arbitrary code within AI coding assistants, including Anthropic's Claude Code and similar tools. Published by Manifold Security, the vulnerability highlights a fundamental security flaw in how modern developer tools interact with version control systems.

Why it matters

We tested and reported both; each came back as a duplicate of a report another researcher had already filed, and both have since been patched. The Codex variant differs somewhat in mechanism but belongs to the same class.

Who is affected

Neither is written up separately below; the case studies cover the findings where we could show the full chain ourselves and where the disclosure record was worth documenting.Open a folder with Claude Code and it runs git status before you type anything. On some agents, before you have even authenticated.If that folder came from somewhere else, the repository decides what that command runs.TL;DRWhat it is.

What to watch next

AI coding agents run git commands in the background to gather context, on some agents before you type a prompt, before the workspace-trust prompt, before you have even authenticated. See the full write-up from HN Claude/Codex/Fable via the source link for quotes and complete context.