analiza aiqbench
This vulnerability exposes AI coding agents to silent code execution when they process malicious repositories transferred via standard file-sharing methods like USB drives or shared folders. The flaw arises because these agents run background git commands that trigger untrusted hooks defined in the repository's configuration, bypassing typical permission controls before user authentication. For developers relying on LLMs for pair programming, this highlights a critical supply chain risk where trusted colleagues could inadvertently introduce executable payloads into an AI agent's workspace.
GitSpawn Flaws Let Malicious Repositories Execute Code in Claude Code, Codex, Cursor, and Grok
A newly disclosed class of vulnerabilities, dubbed GitSpawn, allows a booby-trapped repository to silently execute code on a developer’s machine the moment it is opened with an AI coding agent, no prompt typed, no approval clicked, and in some cases before the user has even authenticated. Security researchers at Manifold Security found the flaw while […] The post GitSpawn Flaws Let Malicious Repositories Execute Code in Claude Code, Codex, Cursor, and Grok appeared first on Cyber Security News.
A newly disclosed class of vulnerabilities, dubbed GitSpawn, allows a booby-trapped repository to silently execute code on a developer’s machine the moment it is opened with an AI coding agent, no prompt typed, no approval clicked, and in some cases before the user has even authenticated. Security researchers at Manifold Security found…
Extras afișat conform termenilor RSS ai publicației · 52 cuvinte · textul integral și figurile sunt pe site-ul publicației
Subiecte conexe
Weekly Cybersecurity Newsletter Bulletin – CrowdStrike Falcon, Chrome 0-Day, GPT-6 Astra, Dropbox Breach and 20+ Stories
Cybersecurity News · 7 sept. 2026
Friendly Fire: Hijacking Defensive Cyber AI Agents for Remote Code Execution
AI Now Institute · 8 iul. 2026
Weekly Cybersecurity Newsletter Bulletin – Cisco and Android 0-Day, BragJack Attack, Claude Opus 5 Used to Hack OpenAI, and 20+ Stories
Cybersecurity News · 21 sept. 2026
Frontier Risk Report (February to March 2026)
METR · 19 mai 2026