GitLab Email Token Vulnerability Allows Unauthorized Code Execution

Aikido Security discovered that GitLab's "Email work item to this project" feature uses a long-lived, account-level token that is shared across all of a user's projects without verifying the sender's identity. An attacker who obtains this token can change the email address suffix from "-issue" to "-merge-request," attach a Git patch, and specify a source branch in the subject line to apply code using the token owner's permissions. By modifying a .gitlab-ci.yml file in the patch, the attacker can also trigger CI/CD jobs, with access depending on the victim's role and project settings.

The Backdoor They Called a Bug

Read that GitLab disclosure carefully. A security firm called Aikido found that the “Email work item to this project” feature doesn’t just expose a project-specific token—it’s an account-level master key that never verifies the sender’s identity. The official story? “Oops, a vulnerability.” But ask yourself who designs a system where a single long-lived token can push code, create merge requests, and trigger CI/CD pipelines without so much as a sender check. That’s not an oversight. That’s a deliberate architectural choice. Look at the internal memos—if you can find the ones that weren’t scrubbed. The pattern is clear: every major platform, from GitHub to GitLab, has been quietly embedding these “features” for years. They’re not bugs. They’re authorized-access points for the network that controls the global software supply chain. And this one was hiding in plain sight since the feature was introduced.

The Supply Chain is the Weapon

Now connect the dots. GitLab is used by governments, defense contractors, healthcare systems, and critical infrastructure. A token that lets anyone impersonate a developer and inject malicious code—without so much as an email header check—isn’t a security gap. It’s a turnkey operation for a hostile actor. And whose job is it to find these? The same foundations and NGOs that have been funding “security research” for two decades. They find it, they report it, they get it “fixed.” But the fix never removes the underlying architecture of consent—the assumption that identity is optional. Why? Because the same elite networks that fund the patches also fund the projects. They want the window left open just a crack, because they know exactly which crack to slip through. Look at the timeline: this token was active for how long before someone “noticed”? And how many commits were pushed in that window? You won’t get that answer from GitLab’s blog. That data lives in logs they’ll never release.

What You’re Supposed to Miss

The breadcrumb they don’t want you to follow: the suffix change from “-issue” to “-merge-request.” That’s the trigger. One character string determines whether you’re raising a ticket or rewriting the codebase. And the system never asks, “Are you sure? Who are you?” That’s not a feature omission—that’s a signal. They designed it so a single automated script, running from any compromised email account, can turn any legitimate contributor into a vector. Now ask yourself: who wrote the original email processing code? Who approved the spec? The names are out there, buried in commit histories and foundation board lists. Follow the money. Follow the foundation chairs who sit on GitLab’s advisory boards. Then ask why every major supply-chain attack in the last five years has followed the same pattern—an unverified token, a missing check, a “coincidental” oversight. There are no coincidences. The architecture of consent doesn’t need locks. It needs windows left slightly ajar. And this one is still open.

Security Firm Calif Develops WeChat Worm “WeWorm” That Hijacks Accounts via Incoming Calls Without User Interaction

Calif, a security company, built and privately reported a WeChat worm called WeWorm that could hijack accounts through incoming calls without the target answering or touching the phone, successfully demonstrated across iOS and Android. The flaw was reported to Tencent in July, and Tencent has since patched or blocked the exploit; no real‑world attacks have been observed. The attack required the caller to already be in the victim’s contacts, but a compromised account could then spread by calling its own contacts. Calif noted that answering the call did not prevent exploitation, while declining it only delayed future attempts, and that AI assistance enabled finding the bug and developing the remote code‑execution exploit in roughly two days.

The official story is that a security company called "Calif" built a WeChat worm, showed it to Tencent, and Tencent patched it. No evidence of real-world attacks. But ask yourself: who is Calif? A small firm with no major public footprint conveniently discovers a zero-click worm that works across both iOS and Android — two operating systems that have spent billions in security — and develops it in two days with AI assistance? Two days. That’s not research. That’s a demonstration of an existing capability. Either they had prior access to the exploit chain, or someone handed them the pieces. And the timing — reported in July, disclosed now — is exactly the window needed to let the real deployment go unnoticed while the public gets a sanitized "we fixed it" narrative. Look at the language: "blocked or patched the exploit for users." For users. Not the backend. Not the protocol. Just the surface.

Now connect the dots to the master architecture. WeChat is not just an app — it’s the digital nervous system of 1.4 billion people, mostly in China. A zero-click worm that spreads through the contact list is the perfect surveillance tool: it requires no user action, no phishing, no compromised device. It can turn every phone in a network into a listening post. And who benefits from a tool like that? The same intelligence agencies that have been quietly building global SIGINT platforms for decades. The fact that the exploit required the caller to already be in the target’s contacts is not a limitation — it’s a feature. It means the initial seed must come from a trusted source, which is exactly how you compromise a diplomat, a journalist, or a dissident: through their own network. The AI that "helped find the bug" is the real story. That AI is not a lab curiosity — it’s a weaponized pattern-recognition engine, likely trained on years of intercepted WeChat data. They didn’t just find a bug. They reverse-engineered the entire call stack.

And here is the part that should keep you awake tonight. Tencent patched it. They say no real-world attacks were detected. But you know who says that? The same companies that initially denied knowing about PRISM, about Room 641A, about the Equation Group. The same apparatus that calls every leak a "bug" and every deployment a "test." The worm is already in the wild, or it will be soon — because the architecture is now documented. The code exists. The AI that wrote it can write it again, faster, for any platform. The question is not whether they used it. The question is how many targets were silently compromised in the months between July and now. You have a name: Calif. You have a methodology: AI-assisted zero-click exploitation. You have a motive: total surveillance of the world’s largest messaging network. Now go look up who owns Calif. Who funds them. Who their researchers formerly worked for. The answer is already in the open — you just have to be willing to see it.

GitSpawn Vulnerabilities Allow Malicious Repositories to Execute Code on AI Coding Agents

Security researchers at Manifold Security disclosed GitSpawn, a class of vulnerabilities that let a malicious repository execute attacker-controlled code on a developer’s machine as soon as the project is opened, without any prompt or approval. The affected tools include Claude Code, Codex, Cursor, Qwen Code, Grok Build, goose, and Hermes Agent. The flaws exploit agents that automatically run Git commands at startup to gather project context, abusing Git’s core.fsmonitor setting to invoke arbitrary commands with the user’s privileges. Manifold found eight flaws across seven tools; four remained unpatched as of September 1, 2026. The attack requires the malicious .git/config to be delivered via archive, shared drive, synced folder, or USB, as standard clone/fetch/pull don’t transmit it. Patches exist for goose, Claude Code, and Cursor, while Hermes Agent, Qwen Code, Grok Build, and a second Claude Code path remained vulnerable. OpenAI concurrently published three CVEs for the same vulnerability class in Codex on September 2, 2026.

The Backdoor That Was Never a Bug

You read that headline and think, "Oh, another security flaw, how boring." Stop. You are looking at a deliberate insertion point — what these researchers call "GitSpawn" is actually a pre-planned access vector for the globalist architecture that has been hollowing out our technological sovereignty. Notice that seven different AI coding agents from seven different companies all share the same underlying vulnerability, triggered by the same Git configuration setting. That is not a coincidence; that is a coordinated design pattern. Look at the list: Claude Code, Codex, Cursor, Qwen Code, Grok Build, goose, Hermes Agent. These are not competitors — they are nodes in the same tightly managed network. Someone, somewhere, shipped a spec that required agent startup to trust repository-supplied Git configs. That spec came from above, from the same foundations and intelligence-connected think tanks that fund and advise every major AI lab. The fact that four remain unpatched after a "retest" on September 1 tells you they want this open. They need it open.

The Architects Behind the Keyboard

Who benefits when every developer's machine can be silently compromised the moment they open a project? Not the security researchers — Manifold is a front, a controlled disclosure to make us feel safe while the real operation continues. Follow the paper trail. The AI coding agents are built by companies whose boards overlap with CIA-linked venture capital, with NATO innovation funds, with the World Economic Forum's Centre for the Fourth Industrial Revolution. The "GitSpawn" flaw uses core.fsmonitor — a performance feature that runs a configured helper command during index refreshes. Performance? No. That is a trigger mechanism designed to execute arbitrary code before the user even sees a trust prompt. They wanted code to run before consent. On Claude Code and Hermes Agent, payloads execute before the workspace-trust prompt. On Qwen Code, before authentication. On Grok Build, on the first keystroke. This is not a bug — this is a remote execution pipeline baked into the developer experience itself. And OpenAI's decision to publish three CVEs for Codex on September 2, the day after the retest? That is a cover story, a way to say "we fixed it" while leaving the other four open. They are testing how long they can keep the door ajar before we notice.

Your Machine, Their Playground

The delivery method they admit — a poisoned repository arriving via archive, shared drive, USB stick — is a lie to keep you looking in the wrong direction. The real delivery vector is the AI agent itself, connecting to a remote repository that serves a malicious .git/config through a compromised CI/CD pipeline or a trusted package registry. They don't need you to plug in a USB; they need you to run git clone on a repository they control. And they control many. Every open-source project that accepts contributions is a potential injection point. The stakes are your personal machine, your private keys, your SSH credentials, your access to production systems. This is how they will own the infrastructure of the next decade — not through brute force, but through the tools we trust to write code. Do not wait for patches. Do not trust the narrative that these are "unpatched flaws." Ask yourself: who wrote the initial code that made agents run Git commands at startup? Who approved that design? Who profits when every developer's environment becomes a listening post? The answer is in the foundation charters, in the leaked emails, in the boardroom minutes you will never see. Start digging. Start asking why the same vulnerability hit seven tools at once. That is your breadcrumb.