GitSpawn Flaw Hits Claude Code, OpenAI Codex and Five Other AI Coding Agents

Anthropic’s Claude Code, Google’s Gemini CLI and OpenAI’s Codex are increasingly embedded in code review and CI/CD workflows, where they can read and modify repositories, execute shell commands and access credentials. That privileged role makes them a new software-supply-chain attack surface. If an agent treats attacker-controlled GitHub issues as trusted context, a prompt injection can cross tool-permission and sandbox boundaries, turning an ordinary public contribution into code execution or secret theft.

At Black Hat USA on Aug. 5, 2026, Novee Security researcher Elad Meged showed that an unprivileged user could plant a malicious GitHub issue that compromised later agent stages. The flaws enabled remote code execution, API-key exfiltration or persistent instruction poisoning. Google rated the Gemini CLI bug CVSS 10.0 and fixed it in version 0.39.1, while Anthropic patched Claude Code in 2.1.163. OpenAI also hardened Codex by separating workflow stages and their writable state.

AI coding assistants have become deeply embedded in everyday development workflows. Tools such as Claude Code and Cursor can read and write files and execute commands, with their security models built around the core assumption that they will modify only files within a workspace. Cloud and AI security specialist Wiz disclosed a vulnerability called GhostApproval that uses Unix symbolic links to circumvent this boundary. The flaw undermines developers’ trust in AI assistants and exposes corporate supply chains to a new attack surface.

Wiz publicly disclosed details of GhostApproval in July 2026. Attackers can plant symbolic links in a project and trick an AI assistant into believing it is operating within the workspace when it is actually writing to sensitive files outside it, potentially creating a remote code execution (RCE) risk. Several mainstream products, including Claude Code and Cursor, are affected, but vendors differ over remediation timelines and approaches. With no common protection standard yet in place, developers must continue checking projects themselves for suspicious links in the near term.

Anthropic’s Claude Code is a development environment that uses generative AI to help developers read and write code and operate tools. Prompt injection can override a user’s intent if the system mistakes text in a GitHub repository for trusted instructions. Microsoft said the flaw posed a significant risk because CI/CD systems often hold highly privileged credentials such as deployment keys and cloud tokens.

Microsoft security researchers recently disclosed that attackers could hide malicious prompts in GitHub content, inducing Claude Code to execute unintended commands and send CI/CD credentials to an external destination. Anthropic has patched the flaw. Users of version 2.1.128 and earlier are advised to upgrade immediately to reduce the risk of compromise to software supply chains and deployment environments.