aiqbench analysis

This vulnerability exposes AI coding agents to silent code execution when they process malicious repositories transferred via standard file-sharing methods like USB drives or shared folders. The flaw arises because these agents run background git commands that trigger untrusted hooks defined in the repository's configuration, bypassing typical permission controls before user authentication. For developers relying on LLMs for pair programming, this highlights a critical supply chain risk where trusted colleagues could inadvertently introduce executable payloads into an AI agent's workspace.