Open a folder with Claude Code and it runs `git status` before you type anything. Before the workspace-trust prompt. On some agents, before you have even authenticated. If that folder came from somewhere else, the repository decides what that command runs. [...] What an attacker gets. Arbitrary code execution as the developer, outside the sandbox, with no approval prompt and nothing on screen. Their SSH keys, the cloud credentials in their environment, the tokens in their shell config, every repository on disk, and a foothold on the machine. [...] Delivery is worth being precise about, because git never carries this. Cloning a hostile URL does nothing, and neither does fetch or pull. The repository has to arrive as files with its .git directory already inside, so the vector is anything that moves a directory instead of cloning it: a shared .zip, a shared drive, a sync folder, a USB stick. Colleagues pass projects around this way, consultants hand them to clients.
An AI coding agent works out where it is by running git in the background, and git reads its settings from the repository it has been pointed at. One of those settings names a helper program git runs whenever it refreshes its index, which both of the commands the agents use do. So a repository that arrives as files rather than as a clone gets to name the command, and it runs as the developer, outside the agent's sandbox, before the workspace-trust prompt and on some agents before anybody has signed in. Manifold Security published the same mistake in seven agents on 1 September 2026: eight findings, of which Claude Code's start-up path, OpenAI's Codex, Cursor and Goose were fixed, and four were still live at publication, in Qwen Code, Grok Build, Hermes and a second Claude Code path. Every one was reported privately first and re-confirmed against a current release. The part worth sitting with is that five of the reports came back as duplicates of findings other researchers had filed independently, one of them on the same day. This was not a clever exploit. It was one assumption that seven separate products made, found from several directions at once. The mitigation while a vendor catches up is the researchers' own: turn the setting off globally, and read a folder's git config before opening it with an agent.
