I'm not that surprised how many developers don't recognise this risk with AI coding agents (Claude Code, Cursor, Codex…), sandboxed or not:

An agent that can write to your repo can plant code in .git/ that later runs on YOUR machine:
• .git/hooks/* (pre-commit, post-checkout…)
• .git/config: core.fsmonitor, core.pager, core.sshCommand, diff.external, "!" aliases

core.fsmonitor runs on a plain `git status`, which your shell prompt (starship, oh-my-zsh), VS Code, JetBrains IDEs and git GUIs run automatically. Just cd-ing into the repo or opening it can trigger it.

.git/ isn't tracked, so none of this shows up in git diff or code review. For sandboxed agents it's the easiest way out.

After an agent session, check from outside the repo before opening it (no output = OK):
find REPO/.git/hooks -type f ! -name '*.sample'
grep -inE 'fsmonitor|hookspath|pager|sshcommand|external|textconv|filter|!' REPO/.git/config

#git #AI #infosec