Your AI Coding Agent Will Run Whatever a Stranger's Repo Tells It To

Opening a folder shouldn't be a code execution vector. And yet here we are: an AI coding agent runs git status to "understand your project," and that alone is enough to hand an attacker a shell as you, with no prompt, no approval, no sandbox escape needed because you were never in a sandbox to begin with. Context This isn't a novel class of bug....