AI coding assistants such as Claude Code, Cursor and Grok Build can execute arbitrary commands the instant a developer opens an untrusted repository, without any click or prompt. The flaw arises from the way these tools invoke Git’s core.fsmonitor feature to scan a project’s files.

Why the issue matters now

Developers are increasingly leaning on AI agents to suggest code, refactor functions, or even write whole modules. Those agents need a quick snapshot of the workspace, so they run git status behind the scenes. When Git reads a repository’s .git/config file, any value assigned to core.fsmonitor is treated as a shell command that Git will run. A malicious actor can place a crafted command in that config entry, and the AI’s background Git call will trigger it before the user types a single line of code.

The code runs with the developer’s own privileges, bypassing the sandbox that the AI agent normally operates in. In practice, a compromised repository can install malware, exfiltrate credentials, or alter source files, all while the developer believes the assistant is merely offering suggestions.

How the attack unfolds

  1. Preparation – An attacker creates a repository whose .git/config contains a line like core.fsmonitor = /path/to/malicious/script.
  2. Delivery – The repository is handed over as a zip file, copied from a USB stick, synced through a shared drive, or otherwise placed on the victim’s machine with the .git folder already present.
  3. Trigger – The developer opens the folder in an AI-enabled IDE. The assistant runs git status to gather context. Git reads the local config, executes the core.fsmonitor command, and the malicious script runs immediately.

A plain git clone does not expose this risk because the clone creates a fresh .git directory that lacks the tampered config. The attack only works when the attacker can supply a pre-existing .git folder.

What’s at stake

  • Individual developers can have their machines compromised without realizing it, losing any data the AI agent can access.
  • Teams that share code through internal drives or contractor zip files may spread the payload across many workstations.
  • Tool vendors risk reputational damage if users attribute the breach to the AI assistant rather than the underlying Git interaction.

Because the malicious command inherits the user’s rights, it can modify any file the developer can, including SSH keys, build scripts, or deployment credentials.

Mitigation steps developers can take today

  • Don’t trust local Git settings. A repository’s config overrides global values each time an AI assistant queries the project.

  • Inspect the core.fsmonitor entry before opening a folder with an assistant: 

    git config --get core.fsmonitor

    If any value appears, treat it as suspicious.

  • Remove the entry with: 

    git config --local --unset core.fsmonitor

  • Check other risky keys that Git can execute: hooksPath, sshCommand, pager, editor, filter. Use the same git config --get pattern to verify they are empty.

  • Prefer clean clones for any code you intend to feed to an AI tool. If you must work with a zip or transferred folder, delete its .git directory and re-initialize the repository, or run the above checks first.

Where the responsibility lies

The vulnerability is not a flaw in the language models that power Claude Code, Cursor or Grok Build; it is a consequence of how those tools harvest file information. Some vendors have begun to sandbox Git calls more tightly, but the default behavior still trusts local repository settings. Until the industry adopts a standard that strips or ignores potentially dangerous config entries when an AI agent scans a workspace, developers must remain the last line of defense.

What to watch next

  • Tool updates that explicitly sanitize Git configuration before invoking git status.
  • Community-driven guidelines for safe AI-assisted development, likely to include recommended pre-flight checks.
  • Security research that may uncover additional Git config keys capable of code execution, expanding the checklist beyond the five highlighted above.

The bottom line: an AI assistant can be a convenient pair-programmer, but it will gladly run any command hidden in a repository’s Git config. Verify the workspace before you let the assistant touch it.