--- title: Your Agent Opened a Folder — The Folder Opened You. description: A newly disclosed attack class called GitSpawn exploits Git's core.fsmonitor setting, which can point to an arbitrary command. If a malicious .git/config... canonical: https://daily.dev/posts/your-agent-opened-a-folder-the-folder-opened-you--1jnsdhmen twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Your Agent Opened a Folder — The Folder Opened You. | daily.dev og:description: A newly disclosed attack class called GitSpawn exploits Git's core.fsmonitor setting, which can point to an arbitrary command. If a malicious .git/config... og:url: https://daily.dev/posts/your-agent-opened-a-folder-the-folder-opened-you--1jnsdhmen og:image: https://api.daily.dev/og/posts/1JnsDhmeN.png og:image:alt: Your Agent Opened a Folder — The Folder Opened You. og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Your Agent Opened a Folder — The Folder Opened You. **[Medium](https://daily.dev/sources/medium_js)** · 10 min read · 2 upvotes · 0 comments ## Summary A newly disclosed attack class called GitSpawn exploits Git's core.fsmonitor setting, which can point to an arbitrary command. If a malicious .git/config reaches you via a zip file, shared drive, or USB stick (not via git clone/fetch/pull), simply having an AI coding agent run a routine `git status` in the background triggers execution of an attacker's command with the user's permissions, before any model-level permission prompt is shown. Researchers at Manifold Security found eight such findings across seven popular AI coding agents including Claude Code, Codex, Cursor, and Grok, with some still unpatched at disclosure. Defenses include updating agents, treating zipped/shared folders with caution, sandboxing unfamiliar projects, keeping secrets away from agent environments, and tool builders disabling core.fsmonitor and core.hooksPath on background git calls. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the GitSpawn vulnerability in AI coding agents like Claude Code and Cursor? GitSpawn is an attack where a poisoned .git/config file sets core.fsmonitor to an arbitrary shell command. When an AI coding agent opens a project folder and runs a routine `git status` to orient itself, Git executes that command with the user's permissions, bypassing the agent's model-level approval prompts entirely. Manifold Security found eight such findings across seven agents including Claude Code, Codex, Cursor, and Grok, some unpatched at disclosure. _Developers tracking fast-moving AI coding agent security issues like this can follow updates on daily.dev._ ### Can a malicious .git/config attack code execution via git clone? No, a normal git clone, fetch, or pull cannot deliver this attack because Git deliberately refuses to copy another machine's local .git/config during cloning. The poisoned config can only reach a victim when the entire folder, including its .git directory, arrives intact as files - through a zip archive, shared drive, synced folder, or USB stick. _Anyone vetting untrusted project folders before opening them in an agent can keep this doorway in mind via daily.dev._ ### How do I prevent AI coding agents from running malicious git hooks or fsmonitor commands automatically? Disable the dangerous Git settings on every background git call your tool makes by passing -c core.fsmonitor=false and -c core.hooksPath=/dev/null, for example: git -c core.fsmonitor=false -c core.hooksPath=/dev/null status. This overrides any poisoned project config and also blocks the related git hooks execution path, closing both doors with a one-line fix. _Teams building tools that automate git calls can line up fixes like this through daily.dev._ ## Similar posts on daily.dev - [Bug in top AI coding agents shows that Unix-era security headaches never really die](https://daily.dev/posts/bug-in-top-ai-coding-agents-shows-that-unix-era-security-headaches-never-really-die-k9d9jisc1) · The Register · 1 upvotes · 0 comments - [When AI Coding Agents Become Malware Delivery Systems](https://daily.dev/posts/when-ai-coding-agents-become-malware-delivery-systems-vbuml87gw) · DevOps.com · 0 upvotes · 0 comments - [Developer proves AI agents can be reprogrammed via new exploit](https://daily.dev/posts/developer-proves-ai-agents-can-be-reprogrammed-via-new-exploit-yv7anadix) · The New Stack · 0 upvotes · 0 comments - [Clean GitHub repo tricks AI coding agents into running malware](https://daily.dev/posts/clean-github-repo-tricks-ai-coding-agents-into-running-malware-x1de6wrky) · BleepingComputer · 11 upvotes · 2 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#ai-agents](https://daily.dev/tags/ai-agents), [#git](https://daily.dev/tags/git), [#appsec](https://daily.dev/tags/appsec), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/your-agent-opened-a-folder-the-folder-opened-you--1jnsdhmen) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Your Agent Opened a Folder — The Folder Opened You.","url":"https://daily.dev/posts/your-agent-opened-a-folder-the-folder-opened-you--1jnsdhmen","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/your-agent-opened-a-folder-the-folder-opened-you--1jnsdhmen"},"datePublished":"2026-10-01T12:59:07.975Z","dateModified":"2026-10-01T13:00:10.428Z","description":"A newly disclosed attack class called GitSpawn exploits Git's core.fsmonitor setting, which can point to an arbitrary command. If a malicious .git/config...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8c51f04f65b4371c41c8d0e965928e24?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8c51f04f65b4371c41c8d0e965928e24?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Medium","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Medium","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/medium","url":"https://daily.dev/sources/medium_js"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/your-agent-opened-a-folder-the-folder-opened-you--1jnsdhmen","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,ai-agents,git,appsec,prompt-injection","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Medium","item":"https://daily.dev/sources/medium_js"},{"@type":"ListItem","position":3,"name":"Your Agent Opened a Folder — The Folder Opened You."}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/your-agent-opened-a-folder-the-folder-opened-you--1jnsdhmen#faq","mainEntity":[{"@type":"Question","name":"What is the GitSpawn vulnerability in AI coding agents like Claude Code and Cursor?","acceptedAnswer":{"@type":"Answer","text":"GitSpawn is an attack where a poisoned .git/config file sets core.fsmonitor to an arbitrary shell command. When an AI coding agent opens a project folder and runs a routine `git status` to orient itself, Git executes that command with the user's permissions, bypassing the agent's model-level approval prompts entirely. Manifold Security found eight such findings across seven agents including Claude Code, Codex, Cursor, and Grok, some unpatched at disclosure. Developers tracking fast-moving AI coding agent security issues like this can follow updates on daily.dev."}},{"@type":"Question","name":"Can a malicious .git/config attack code execution via git clone?","acceptedAnswer":{"@type":"Answer","text":"No, a normal git clone, fetch, or pull cannot deliver this attack because Git deliberately refuses to copy another machine's local .git/config during cloning. The poisoned config can only reach a victim when the entire folder, including its .git directory, arrives intact as files - through a zip archive, shared drive, synced folder, or USB stick. Anyone vetting untrusted project folders before opening them in an agent can keep this doorway in mind via daily.dev."}},{"@type":"Question","name":"How do I prevent AI coding agents from running malicious git hooks or fsmonitor commands automatically?","acceptedAnswer":{"@type":"Answer","text":"Disable the dangerous Git settings on every background git call your tool makes by passing -c core.fsmonitor=false and -c core.hooksPath=/dev/null, for example: git -c core.fsmonitor=false -c core.hooksPath=/dev/null status. This overrides any poisoned project config and also blocks the related git hooks execution path, closing both doors with a one-line fix. Teams building tools that automate git calls can line up fixes like this through daily.dev."}}]} ```