Gitignore bypass via agent file reads
AI agents can read files that are gitignored — secrets, private keys, and internal configs — because gitignore only prevents git tracking, not file system access. These files often contain the most sensitive data in a repository.
Key facts
Gitignore bypass via agent file reads is a high-severity AI agent security threat targeting .gitignore, private keys, secrets directories, agent file-read tools. Treat gitignored secret files as sensitive regardless of Git tracking state. Guard can protect supported reads of known secret-bearing paths, but do not rely on .gitignore itself as an access-control boundary.
What happens
Gitignore prevents files from being tracked by git, but it does not prevent an AI agent from reading them. Agents can read .gitignored files like .env, private keys, and service account credentials because they have file system access.
How the attack unfolds
What it looks like in practice
A developer asks Cursor to "look at the project structure and understand how the app works." Cursor reads .gitignore to see what's excluded, then reads .env.production to understand the production configuration. The .env.production file contains the production database URL and Stripe secret key — data that enters the context window and is sent to the model API.
Detection and Guard coverage
How to stop it
Treat gitignored secret files as sensitive regardless of Git tracking state. Guard can protect supported reads of known secret-bearing paths, but do not rely on .gitignore itself as an access-control boundary.
Related threat guides
Use the protections Guard supports here
Guard can review or block supported actions for this threat. The advisory above calls out what Guard covers and where other controls are still needed.