Git operations such as status and diff can refresh the index, and the refresh path may execute repository-configured helpers. If the agent passes that config through unchanged, an attacker-controlled workspace can run code on the developer machine. The risk is not the command name alone, but the combination of local trust, inherited privileges, and hidden execution hooks.
Why the risk is not the git command itself
Unsanitised git calls become dangerous when an AI coding agent inherits a workspace that the attacker has already influenced. In that situation, a routine command such as status or diff can do more than read metadata, because git may refresh the index and follow repository-configured execution paths. The security problem is the trust boundary, not the verb.
That is why this issue shows up in agentic development environments more than in ordinary local use. The agent often runs with the developer’s session, file access, and environment, so a hidden helper or config-driven hook can turn a harmless-looking read operation into code execution on the developer machine.
For a practical example of how attacker-controlled repository state can turn normal developer activity into execution, see Gemini CLI prompt injection flaw 2025 and Amazon Q MCP config vulnerability 2026.
How repository trust becomes execution risk
The failure mode is usually a chain, not a single bug. A malicious repository can place configuration, helper paths, or adjacent files so that a tool invoked for inspection triggers side effects during refresh, parsing, or helper lookup. If the agent passes through inherited configuration without tightening it, the local machine becomes the execution surface.
This risk is stronger when the agent can reach the developer’s secrets, tokens, or signed-in tooling. Code execution then becomes a bridge to credential theft, repository tampering, or lateral movement into other systems. The same pattern also appears in AI coding assistants that trust workspace content too much, so the control question is always where execution authority ends, not whether the command sounds read-only.
The broader category is well illustrated by AI Coding Agents Security Guide, Analysis of Claude Code Security, and TrapDoor supply chain campaign 2026.
What practitioners should verify before trusting git inside an agent
Assume the workspace can be hostile until proven otherwise. The useful check is whether the agent is allowed to inherit repository-controlled behavior, environment variables, and helper lookup paths while operating on untrusted code. If the answer is yes, then even simple inspection commands deserve the same scrutiny you would give to an execution path.
Practitioners should also distinguish read intent from effect. A command may be issued for visibility, but the implementation may still touch local state, refresh metadata, or invoke helpers. That means safe use depends on sandboxing, path restrictions, and explicit policy for what the agent may execute from the workspace.
For guidance on constraining authority rather than trusting the command name, see AI Agent Authorisation Guide and Identity Governance for AI Agents Guide.
Risk and Threat Considerations
When an AI coding agent processes an attacker-influenced repository, unsanitised git calls can convert ordinary inspection into local code execution. The danger is highest when the agent runs with developer-level trust and has access to session material, source control credentials, or cloud tokens.
Failure mechanism: Git refresh or helper resolution follows repository-controlled configuration, and the agent inherits that execution path without sanitising or isolating it.
Impact: An attacker can execute code on the developer machine, steal secrets, alter repositories, or pivot into connected systems through the developer’s trusted context.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI05 — Unexpected Code Execution | Git helper-triggered execution inside an agent is an unintended code execution path. |
| ASI03 — Identity & Privilege Abuse | The risk hinges on the agent inheriting the developer's privileges and trusted context. | |
| Recommendation — Constrain agent actions so workspace input cannot trigger unexpected code execution. Limit agent privilege so inherited developer authority cannot be abused by workspace content. | ||
| MITRE ATT&CK | T1204 — User Execution | The attacker relies on local trust and user-facing tooling to get code running on the endpoint. |
| Recommendation — Harden endpoints and inspection workflows against content that causes execution during review. | ||
| OWASP Non-Human Identity Top 10 | NHI-10 — Human Use of NHI | The agent uses repository-held material and credentials in a way that can enable unsafe action. |
| Recommendation — Separate human review workflows from machine-driven execution paths that consume repository state. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Repository-exposed secrets or tokens can be consumed if execution exposes credential material. |
| Recommendation — Protect and rotate credentials that a compromised workspace or agent session could expose. | ||
Practitioner Guidance
What to verify: Confirm whether your agent runtime strips or overrides repository-configured helpers, unsafe hooks, and inherited execution settings before it invokes git in an untrusted workspace.
Common mistake: Treating status and diff as low-risk read operations and allowing them to run with full developer trust. In practice, the relevant question is whether the command can trigger behavior, not whether it was meant to inspect state.
Practitioner takeaway: Lock down the agent’s execution boundary first, because if untrusted repository state can influence local helper resolution, a harmless git command can become a code execution path.
Related resources from NHI Mgmt Group
- Why do AI coding agents create more risk than static code scanners alone can handle?
- Why do AI coding agents create architectural risk even when code compiles and tests pass?
- Why do repo-defined workflows create risk for AI coding agents reviewing untrusted code?
- How should security teams reduce the risk of AI coding agents turning a file-copy workflow into remote code execution?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org