Opening a folder shouldn't be a code execution vector. And yet here we are: an AI coding agent runs git status to "understand your project," and that alone is enough to hand an attacker a shell as you, with no prompt, no approval, no sandbox escape needed because you were never in a sandbox to begin with.
Context
This isn't a novel class of bug. .git/config and core.fsmonitor abuse for command execution has been kicking around the git security world for a while, related tricks have shown up in supply chain attacks against plain old git clients for years. What's new is the blast radius. Coding agents like Claude Code, Cursor, Codex, Grok, Goose, Hermes, and Qwen Code all independently decided that shelling out to git for context (diffs, status, log) was a reasonable design choice. It is, for a normal git client used by a human who typed the clone command themselves. It's a very different story when the whole selling point of the tool is "point me at a codebase and I'll figure it out," because now the trust boundary that used to require a human to run git status inside a hostile repo has been quietly automated away.
So: known primitive, newly reachable by a much larger and much less careful set of triggers.
