Manifold Security found eight Git configuration flaws across seven CLI AI coding agents, and four were still unpatched when it retested them on Sept. 1. OpenAI also published related Codex CVEs the same day for the same command-execution class.
The trick is simple: a repository can carry .git settings that name a command, and the agent runs Git in the background to learn its branch and changed files. That Git check can fire the command as the user, before an approval prompt or workspace-trust check appears, so a received project can turn into local code execution with the developer's privileges.
That matters most when code arrives with its .git directory intact — for example in archives, shared drives, sync folders, or USB-delivered repos — because the danger lives in the metadata the tool reads, not just the code it opens. If your workflow auto-runs Git checks, the blast radius is the workstation and account, not the cloned project alone.