Here is a nasty one. A malicious .git/config can execute when a coding agent merely gathers context — before any approval exists, before the agent does anything you would call an action. Seven agents were hit, including Claude Code, Cursor, and Codex. Eight findings. Four were still unpatched as of September 1.

Think about what that means for every approval screen you have ever seen. The approval gate only works if nothing dangerous happens before the gate. Here, the dangerous thing happens during the look-around. The agent is not misbehaving. It is reading a repo file, and the repo file is a trap.

This is the side I build for. Full disclosure, it is my project. Sentinel is an inbound governor: it inspects what the agent hears before the brain sees it. Its law is simple. Only the owner issues instructions. Everything else is data, never orders.…