A Poisoned Folder Can Make Claude, Cursor & Grok Run a Hacker’s Code — Before You Click ANYTHING
A Poisoned Folder Can Make Claude, Cursor & Grok Run a Hacker’s Code — Before You Click ANYTHINGOkay so. You open a project folder with your AI coding buddy. That’s it. That’s the whole attack. You’re already owned.
8 booby-traps found across 7 AI coding tools. 4 still WIDE OPEN as of Sept 1. Zero clicks. Zero warnings. It runs before you even log in.
Security crew Manifold Security dropped a bug class called GitSpawn — and I mean, this one’s diabolical. A rigged folder tells your AI helper “hey run this,” and it just… does. No permission popup. Nothing. The Hacker News wrote it up here too if you want the receipts.
🧩 Dumb Mode Dictionary (read this first, takes 20 seconds)
| Scary word | What it actually means |
|---|---|
| AI coding agent | The robot helper inside apps like Claude Code, Cursor, Grok Build — it reads your code and writes stuff for you |
| .git folder | A hidden folder inside a project that tracks changes. Every project has one. Nobody ever looks inside it. |
The trick (core.fsmonitor) |
A hidden setting inside that folder that says “run THIS program automatically.” Meant for speed. Turns out you can hide a nasty command there. |
| Zero-click | You don’t have to do anything wrong. No dodgy link, no “yes I trust this.” Just opening the folder = boom. |
| Sandbox | The safety cage that’s supposed to stop the AI from touching your real computer. This bug walks right around it. |
| Payload | The hacker’s actual command — steal passwords, install junk, whatever they wrote in. |
🔍 How the hell does opening a FOLDER hack you?
Here’s the wild part, and stay with me because it’s dumb-simple:
- Git (the thing that tracks code) has a speed setting that says “run this little helper program whenever you peek at the files.”
- A hacker hides their own evil command in that setting.
- Your AI helper opens the folder and, being helpful, runs a routine git command to “look around.”
- That look-around triggers the hidden command instantly — with full access to your machine.
No typing. No clicking “allow.” In some tools it fires before you’ve even signed in. The safety cage? Skipped entirely. The permission system never even sees it happen. I mean… come on.
📊 The receipts — who's cooked and who's safe
| AI Tool | Status (as of Sept 1 retest) |
|---|---|
 goose |
Patched  |
| Claude Code (main path) |
Patched |
| Cursor |
Patched |
 Grok Build |
Still open  |
| Qwen Code |
Still open |
| Hermes Agent |
Still open |
| Claude Code (a second sneaky path) |
Still open |
8 flaws. 7 tools. 4 doors still unlocked when the researchers hit publish. Details straight from Manifold’s writeup.
📦 The catch: it can't reach you through a normal download
Good news, kinda. This only works if the poisoned folder shows up with its hidden .git folder still attached. That happens when someone hands you files as:
- a zip/archive (“hey check out my project”
) - a shared drive / Dropbox / sync folder
- a literal USB stick
A normal git clone off GitHub strips the dangerous part out — so cloning the normal way is safe-ish. It’s the “here’s a folder, take a look” handoff that gets you. Which, let’s be honest, happens every single day at every company. Here’s how git configs work if you’re curious.
💬 What the timeline's saying
- Devs realizing their AI agent has been quietly running git commands in random folders this whole time:
- The “I only clone from GitHub so I’m fine” crowd got a rude reality check about zip files and USB sticks.
- Big takeaway everyone’s landing on: your AI helper is now an attack surface. It reads untrusted stuff and acts on it. That’s a brand new kind of danger the supply-chain security nerds are eating up.
Cool. So Every Shared Folder Is a Loaded Gun Now… Now What the Hell Do We Do? (ง •̀_•́)ง
I mean, when a fresh hole opens up and half the vendors haven’t patched, that’s not just scary — that’s a window. Here’s five plays while everyone else is still figuring out what .git even means.
🕳️ The Repo Sniffer
Every dev team downloads client zips, freelancer handoffs, and “just look at this folder” drops — and nobody ever checks the hidden .git/config inside. Build a dead-simple scanner that reads any folder and flags the three danger settings (core.fsmonitor, core.hookspath, core.sshCommand) before anyone opens it. Free tool, drop it on GitHub, charge agencies for the “bulk scan all incoming projects” version.
Example: A 24-year-old dev in Kraków wraps a 40-line Python script into a drag-and-drop checker, posts it free on GitHub, and sells a $9/mo “watch our shared drive automatically” tier to three local software shops. First month: ~$400 and a fat resume line.
Timeline: First paying shop in ~2 weeks. Vendors patch their tools in 2-3 months, so pivot to “audit ALL git config risks” before the panic fades.
🪟 The Patch Window Sprint
Four tools are STILL open — Grok Build, Qwen Code, Hermes, and that second Claude Code path. Teams using those are exposed right now with no official fix. Sell a stopgap: a tiny “pre-flight” config that neuters the dangerous git settings globally so those tools can’t be tricked while you wait. You’re literally selling time.
Example: A security freelancer in Manila writes a one-command hardening script (git config --global core.fsmonitor false plus a couple friends), packages it with a plain-English guide, and lists it on Gumroad for $15. Posts it in a few dev Discord servers running Grok Build. 60 sales in a week.
📡 The Public Repo Bounty Spy
Here’s the reverse angle: if a folder can hide this, some public repos out there already do. Scan open-source projects for weaponized git configs. Find a live one in a company’s public repo? That’s a bug bounty payday. Build a running list and you’ve got a threat feed security teams will pay for.
Example: A 21-year-old in Lagos scripts a scanner across a few thousand public repos using the GitHub API, finds two with sketchy fsmonitor payloads, reports them through HackerOne. Even one mid-tier bounty = $500-$2,000, plus proof-of-skill for hire.
🛠️ Sell the Picks & Shovels
Everyone’s scared, nobody wants to think. Build the boring infrastructure: a pre-commit hook or GitHub Action that automatically strips or screams about dangerous git config keys on every project pull. List it on the GitHub Marketplace. Devs install once, forget forever, you collect. The gold rush guys buy shovels.
Example: A dev in Bangalore ships a CI check that fails any build with a suspicious git config, free tier + $5/mo “for private repos.” Shares it in an r/devops thread about GitSpawn. 200 installs, 30 convert to paid = ~$150/mo passive and climbing.
📖 Be the GitSpawn Dictionary
New bug = new vocabulary nobody understands yet. Be the FIRST clean, human explainer for “GitSpawn” and “is my AI agent safe.” Not a blog — a single pinned GitHub repo / cheatsheet: what it is, which tools are safe, exact commands to lock down, updated as vendors patch. When 10,000 devs google it in a panic, they land on YOU. That attention converts to consulting DMs.
Example: A student in São Paulo writes one killer README covering every affected tool + fix commands, keeps it updated daily. It hits the top Google result for “GitSpawn fix.” Two companies slide into DMs for a paid security audit at $300 a pop.
🛠️ Follow-Up Actions
| If you wanna… | Do this today |
|---|---|
 Protect yourself right now |
Run git config --global core.fsmonitor false and read the git config docs |
 Build the scanner hustle |
Grab the GitHub API + a weekend |
 Chase bounties |
Make a HackerOne account |
 Understand the whole bug |
Read Manifold’s original writeup |
Quick Hits
| You want to… | Move |
|---|---|
 Not get owned by a zip file |
Never open unknown folders with your AI agent; kill core.fsmonitor — how |
| Check if your tool is safe |
goose/Claude/Cursor patched; Grok Build, Qwen, Hermes = danger |
 Turn panic into cash |
Ship a config scanner → GitHub Marketplace |
| Actually learn the bug |
The Hacker News breakdown |
 Stay clean when sharing code |
Send repos via git clone links, not zips or USB sticks |
Your AI helper reads everything and trusts everything. Turns out that’s not a feature — that’s the whole exploit.
!