Git config can execute before agent approval

A security research post found that starting Claude Code, Goose, Grok Build, Hermes, or Qwen Code in a repository can run a Git-configured command before an approval prompt. The command runs on the host with the user’s privileges.

Git refreshes its index for common context checks such as status and diff. A repository’s core.fsmonitor setting can name the helper Git runs during that refresh.

Cloning, fetching, and pulling don’t carry the configuration. The researchers used .zip files containing the repository’s .git directory for every proof of concept.