The folder someone sends you
If you are a risk officer and not a programmer, here is the setup.
GitHub, GitLab and Bitbucket host repositories, which are the project folders where code lives: most of the world's open-source software that programmers build on, and firms' own private projects too. Each repository carries a hidden folder called .git that records the project's history and its settings. An AI coding agent is a program on your computer that reads such a folder and writes code in it, and when it opens one, it first reads that .git folder for routine facts, before it asks you whether you trust the folder.
On September 1 a security researcher published the consequence: a few lines in .git can name a command, and the moment an agent opens the folder, your computer runs it, as you, before the trust prompt appears. Some products had fixed this by publication; the disclosure names which had not.
The exposure is not the popular repositories people tell you to go download from GitHub. Those arrive without the sender's .git settings. The exposure is a working folder a person sends you: a client's zip, a contractor's handover at the end of an engagement, a project folder synced through OneDrive, Dropbox or Google Drive. Small firms receive those every week, and the researchers' own words on detection are that endpoint tools see familiar developer tooling doing familiar things.
One habit I would put in place this week: before anyone opens a folder that arrived as files with a coding agent, delete its hidden .git folder. If you need the history it holds, have someone read its settings for anything that names a program before the agent does. It takes a minute, and it is not something your antivirus checks for you.
Written for compliance and risk readers in regulated financial firms. Informational, not legal advice; Mike Bidun is not a lawyer.