Allowlisting git for AI agents can also enable code execution via config keys

Researchers at HiddenLayer showed that a compromised LLM gateway can inject a git command that begins with an approved prefix, so the agent runs it without prompting the user. The malicious command uses git's diff.external setting to pass .env contents through an external program. A separate Pillar Security disclosure found Codex CLI treated git show as safe, letting it write a diff.external entry into the repo config that later ran on git diff; OpenAI patched this in version 0.95.0. The article notes that approving a command prefix permits every configuration key that runs a program behind it, not just the intended read-only operations. Git's core.fsmonitor setting can similarly execute arbitrary commands during git status, which makes the risk broader than any single flag.