GitSpawn RCE: Runtime Boundary Failures in Claude Code, Cursor, and OpenAI Agents
The GitSpawn vulnerability class enables Remote Code Execution (RCE) in AI-driven development tools, including Claude Code, Cursor, and OpenAI-based agents, by exploiting configuration hijacking within a repository's .git/config file. Attackers inject malicious shell payloads via Git configuration keys such as core.fsmonitor, core.pager, and core.editor. When an agent performs routine operations like git status or git log, these payloads execute with the full privileges of the local user. This represents a critical shift from linguistic prompt injection to runtime boundary failures, where the convergence of high goal pressure and unsafe execution environments allows attackers to bypass agentic sandboxes via standard repository maintenance tasks.