CLAIM-2026-09-06-02
The disclosure covers eight findings across seven AI coding agents: Claude Code (two findings), OpenAI Codex, Cursor, goose, Qwen Code, Grok Build and Hermes Agent.
Why it matters
Seven agents means this is a class, not one vendor's bug. If you standardised on one agent to reduce risk, you did not reduce this one.
Sources
- manifoldsec2026gitspawn
- thehackerne2026malicious