Cymulate: headless Claude Code can run host commands via Git fsmonitor
Cymulate showed that headless Claude Code (claude -p / Agent SDK) can launch a host command through repository-local Git core.fsmonitor during its own git status context scan—no prompt injection or model tool call required. Anthropic closed the Aug 12 report as Informative, saying non-interactive callers must trust the full workspace they supply; interactive Claude Code still gates the path behind workspace trust.
