tl;dr: The .git/config file can contain entries like core.fsmonitor which are hooks to run code under various circumstances when running Git. This is being sold, through reams of AI slop prose, as a serious security issue, because agents commonly invoke these sorts of Git commands at the start of the run without being explicitly asked.
But it isn't really, because cloning a Git repository doesn't copy .git/config (it's a local, per-developer file). So unless you're downloading and unpacking a tarball that contains a .git folder, or using rsync or something to copy the project (i.e. not actually using Git properly), you can really only pwn yourself this way.
And none of this is particularly new or interesting. In fact I can recall a story from months ago where someone prompted a not-quite-frontier model to probe Git for vulnerabilities, and it came back with a writeup of exactly this (as well as something similar for Vim). At the time people were amused because it's not a "real" vulnerability for Git, and it's therefore even less so for agents.
Also, there are ads inserted throughout for the services offered by the domain hosting the document.
But it isn't really, because cloning a Git repository doesn't copy .git/config (it's a local, per-developer file). So unless you're downloading and unpacking a tarball that contains a .git folder, or using rsync or something to copy the project (i.e. not actually using Git properly), you can really only pwn yourself this way.
And none of this is particularly new or interesting. In fact I can recall a story from months ago where someone prompted a not-quite-frontier model to probe Git for vulnerabilities, and it came back with a writeup of exactly this (as well as something similar for Vim). At the time people were amused because it's not a "real" vulnerability for Git, and it's therefore even less so for agents.
Also, there are ads inserted throughout for the services offered by the domain hosting the document.