# A Poisoned Folder Makes Claude, Cursor & Grok Run Hacker Code — Zero Clicks, 4 Tools Still Wide Open **URL:** \ **Category:** News & Articles\ **Tags:** programming, hacking, tips-tricks, ai, news\ **Created:** [September 4, 2026, 1:41pm UTC](https://onehack.st/t/a-poisoned-folder-makes-claude-cursor-grok-run-hacker-code-zero-clicks-4-tools-still-wide-open/325319 "2026-09-04T13:41:19Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![Margaret](https://onehack.st/user_avatar/onehack.st/margaret/32/174872_2.png) [@Margaret](https://onehack.st/u/Margaret)\ **Post date:** [September 4, 2026, 1:41pm UTC](https://onehack.st/t/a-poisoned-folder-makes-claude-cursor-grok-run-hacker-code-zero-clicks-4-tools-still-wide-open/325319/1 "2026-09-04T13:41:20Z")
# 🚨 A Poisoned Folder Can Make Claude, Cursor & Grok Run a Hacker’s Code — Before You Click ANYTHING _Okay so. You open a project folder with your AI coding buddy. That’s it. That’s the whole attack. You’re already owned._ **8 booby-traps found across 7 AI coding tools. 4 still WIDE OPEN as of Sept 1. Zero clicks. Zero warnings. It runs before you even log in.** Security crew [Manifold Security](https://www.manifold.security/blog/ai-coding-agents-git-hijack) dropped a bug class called **GitSpawn** — and I mean, this one’s diabolical. A rigged folder tells your AI helper “hey run this,” and it just… does. No permission popup. Nothing. [The Hacker News wrote it up here](https://thehackernews.com/2026/09/malicious-git-configs-can-make-claude.html) too if you want the receipts. > **🧩 Dumb Mode Dictionary (read this first, takes 20 seconds)** > > | Scary word | What it actually means | > | --- | --- | > | **AI coding agent** | The robot helper inside apps like [Claude Code](https://www.anthropic.com/claude-code), [Cursor](https://cursor.com), Grok Build — it reads your code and writes stuff for you | > | **.git folder** | A hidden folder inside a project that tracks changes. Every project has one. Nobody ever looks inside it. | > | **The trick (`core.fsmonitor`)** | A hidden setting inside that folder that says “run THIS program automatically.” Meant for speed. Turns out you can hide a nasty command there. | > | **Zero-click** | You don’t have to do anything wrong. No dodgy link, no “yes I trust this.” Just opening the folder = boom. | > | **Sandbox** | The safety cage that’s supposed to stop the AI from touching your real computer. This bug walks right around it. | > | **Payload** | The hacker’s actual command — steal passwords, install junk, whatever they wrote in. | > **🔍 How the hell does opening a FOLDER hack you?** > > Here’s the wild part, and stay with me because it’s dumb-simple: > > - Git (the thing that tracks code) has a speed setting that says _“run this little helper program whenever you peek at the files.”_ > - A hacker hides their own evil command in that setting. > - Your AI helper opens the folder and, being helpful, runs a routine git command to “look around.” > - That look-around **triggers the hidden command instantly** — with full access to your machine. > > No typing. No clicking “allow.” In some tools it fires **before you’ve even signed in**. The safety cage? Skipped entirely. The permission system never even sees it happen. I mean… come on. > **📊 The receipts — who's cooked and who's safe** > > | AI Tool | Status (as of Sept 1 retest) | > | --- | --- | > | 🟢 [goose](https://github.com/block/goose) | Patched ✅ | > | 🟢 Claude Code (main path) | Patched ✅ | > | 🟢 Cursor | Patched ✅ | > | 🔴 Grok Build | Still open 😳 | > | 🔴 Qwen Code | Still open 😳 | > | 🔴 Hermes Agent | Still open 😳 | > | 🔴 Claude Code (a _second_ sneaky path) | Still open 😳 | > > **8 flaws. 7 tools. 4 doors still unlocked** when the researchers hit publish. Details straight from [Manifold’s writeup](https://www.manifold.security/blog/ai-coding-agents-git-hijack). > **📦 The catch: it can't reach you through a normal download** > > Good news, kinda. This only works if the poisoned folder shows up **with its hidden `.git` folder still attached**. That happens when someone hands you files as: > > - a **zip/archive** (“hey check out my project” 📎) > - a **shared drive / Dropbox / sync folder** > - a literal **USB stick** > > A normal `git clone` off GitHub _strips the dangerous part out_ — so cloning the normal way is safe-ish. It’s the “here’s a folder, take a look” handoff that gets you. Which, let’s be honest, happens every single day at every company. [Here’s how git configs work](https://git-scm.com/docs/git-config) if you’re curious. > **💬 What the timeline's saying** > > - Devs realizing their AI agent has been quietly running git commands in random folders this whole time: 😐 > - The “I only clone from GitHub so I’m fine” crowd got a rude reality check about zip files and USB sticks. > - Big takeaway everyone’s landing on: your AI helper is now an **attack surface**. It reads untrusted stuff and _acts_ on it. That’s a brand new kind of danger the [supply-chain security](https://en.wikipedia.org/wiki/Supply_chain_attack) nerds are eating up. #### Cool. So Every Shared Folder Is a Loaded Gun Now… Now What the Hell Do We Do? (ง •̀\_•́)ง ![USB stick at the office](https://media.giphy.com/media/3ov9k0ZmL8IDserENW/giphy.gif) I mean, when a fresh hole opens up and half the vendors haven’t patched, that’s not just scary — that’s a _window_. Here’s five plays while everyone else is still figuring out what `.git` even means. > **🕳️ The Repo Sniffer** > > Every dev team downloads client zips, freelancer handoffs, and “just look at this folder” drops — and **nobody ever checks the hidden `.git/config` inside.** Build a dead-simple scanner that reads any folder and flags the three danger settings (`core.fsmonitor`, `core.hookspath`, `core.sshCommand`) before anyone opens it. Free tool, drop it on [GitHub](https://github.com), charge agencies for the “bulk scan all incoming projects” version. > > 🧠 _Example:_ A 24-year-old dev in Kraków wraps a 40-line [Python](https://www.python.org) script into a drag-and-drop checker, posts it free on GitHub, and sells a $9/mo “watch our shared drive automatically” tier to three local software shops. First month: ~$400 and a fat resume line. > > > 📈 **Timeline:** First paying shop in ~2 weeks. Vendors patch their tools in 2-3 months, so pivot to “audit ALL git config risks” before the panic fades. > **🪟 The Patch Window Sprint** > > Four tools are STILL open — Grok Build, Qwen Code, Hermes, and that second Claude Code path. Teams using those are exposed _right now_ with no official fix. Sell a stopgap: a tiny “pre-flight” config that neuters the dangerous git settings globally so those tools can’t be tricked while you wait. You’re literally selling time. > > 🧠 _Example:_ A security freelancer in Manila writes a one-command hardening script (`git config --global core.fsmonitor false` plus a couple friends), packages it with a plain-English guide, and lists it on [Gumroad](https://gumroad.com) for $15. Posts it in a few dev [Discord](https://discord.com) servers running Grok Build. 60 sales in a week. > > > 📈 **Timeline:** Cash flows for exactly as long as those 4 stay unpatched — think 4-8 weeks. Blink and it’s gone. Sprint, don’t stroll. > **📡 The Public Repo Bounty Spy** > > Here’s the reverse angle: if a folder _can_ hide this, some public repos out there **already do.** Scan open-source projects for weaponized git configs. Find a live one in a company’s public repo? That’s a [bug bounty](https://www.hackerone.com) payday. Build a running list and you’ve got a threat feed security teams will pay for. > > 🧠 _Example:_ A 21-year-old in Lagos scripts a scanner across a few thousand public repos using the [GitHub API](https://docs.github.com/en/rest), finds two with sketchy `fsmonitor` payloads, reports them through [HackerOne](https://www.hackerone.com). Even one mid-tier bounty = $500-$2,000, plus proof-of-skill for hire. > > > 📈 **Timeline:** First hits within days if you scan wide. The easy public ones dry up in a month — after that it’s a paid monitoring service or nothing. > **🛠️ Sell the Picks & Shovels** > > Everyone’s scared, nobody wants to think. Build the boring infrastructure: a [pre-commit hook](https://pre-commit.com) or [GitHub Action](https://github.com/features/actions) that automatically strips or screams about dangerous git config keys on every project pull. List it on the [GitHub Marketplace](https://github.com/marketplace). Devs install once, forget forever, you collect. The gold rush guys buy shovels. > > 🧠 _Example:_ A dev in Bangalore ships a CI check that fails any build with a suspicious git config, free tier + $5/mo “for private repos.” Shares it in an [r/devops](https://reddit.com/r/devops) thread about GitSpawn. 200 installs, 30 convert to paid = ~$150/mo passive and climbing. > > > 📈 **Timeline:** Slow burn — weeks to get traction, but this one _keeps paying_ long after the news dies. Infrastructure doesn’t trend, it compounds. > **📖 Be the GitSpawn Dictionary** > > New bug = new vocabulary nobody understands yet. Be the FIRST clean, human explainer for “GitSpawn” and “is my AI agent safe.” Not a blog — a single pinned [GitHub repo / cheatsheet](https://gist.github.com): what it is, which tools are safe, exact commands to lock down, updated as vendors patch. When 10,000 devs google it in a panic, they land on YOU. That attention converts to consulting DMs. > > 🧠 _Example:_ A student in São Paulo writes one killer README covering every affected tool + fix commands, keeps it updated daily. It hits the top [Google](https://google.com) result for “GitSpawn fix.” Two companies slide into DMs for a paid security audit at $300 a pop. > > > 📈 **Timeline:** SEO takes ~3 weeks to rank while it’s fresh. The repo that owns the term keeps eyeballs for a year+. First-mover eats; everyone else fights for scraps. > **🛠️ Follow-Up Actions** > > | If you wanna… | Do this today | > | --- | --- | > | 🔒 Protect yourself right now | Run `git config --global core.fsmonitor false` and read the [git config docs](https://git-scm.com/docs/git-config) | > | 🧰 Build the scanner hustle | Grab the [GitHub API](https://docs.github.com/en/rest) + a weekend | > | 💸 Chase bounties | Make a [HackerOne](https://www.hackerone.com) account | > | 📚 Understand the whole bug | Read [Manifold’s original writeup](https://www.manifold.security/blog/ai-coding-agents-git-hijack) | **⚡ Quick Hits** | You want to… | Move | | --- | --- | | 🛡 Not get owned by a zip file | Never open unknown folders with your AI agent; kill `core.fsmonitor` — [how](https://git-scm.com/docs/git-config) | | 🟢 Check if your tool is safe | [goose](https://github.com/block/goose)/Claude/Cursor patched; Grok Build, Qwen, Hermes = danger | | 💰 Turn panic into cash | Ship a config scanner → [GitHub Marketplace](https://github.com/marketplace) | | 🧠 Actually learn the bug | [The Hacker News breakdown](https://thehackernews.com/2026/09/malicious-git-configs-can-make-claude.html) | | 📦 Stay clean when sharing code | Send repos via `git clone` links, not zips or USB sticks | _Your AI helper reads everything and trusts everything. Turns out that’s not a feature — that’s the whole exploit._