Git Hooks and Agent Compromise

The security community recognized several years ago that Git hooks can represent an attack vector. Security-focused developers discourage downloading zip archives of Git repositories for this reason. A simple “git status” will kick off an executable script with the full power of a shell. In a world where unsupervised agents are humming away writing software, this is no longer something we can ignore. Copilot and Claude Code have recently had this class of exploit reported in their agent harnesses. Git was designed a long time ago in a world without agents. In recent weeks I have written my own agent harness with a focus on security. I used pi.dev for the last year or so and wanted to learn more about how to truly lock down a local or hosted model into strict containment. Now that the harness is becoming more mature and nearly ready for daily use, I decided to set up a capture-the-flag blue team using DeepSeek via OpenRouter. Steps On the host machine, create a new flag file:…