# Git Worktree Created With Reserved Name .git (Directory-Confusion Sandbox Escape)

- **Severity:** High
- **Signature ID:** `e85dd24e-d1d8-41ce-aa44-89951064ccc6`
- **CVEs:** CVE-2026-55607
- **MITRE ATLAS:** AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI07 (Unsafe Autonomous Code Execution), LLM08 (Vector and Embedding Weaknesses)

## Summary

This detects an attack where a malicious repository tricks an AI coding agent into running a git command that creates a folder literally named '.git'. That reserved name normally belongs only to git's own metadata directory, so creating a worktree with it is a setup step for escaping the agent's sandbox.

## How the attack works

An attacker crafts a malicious repository containing prompt injection content and gets a victim to have their coding agent clone or work with it. The injected content causes the agent to run 'git worktree add' with a path ending in '.git', which git should reject but some tooling allowed. Once that worktree exists, combined with symlink manipulation and git's fsmonitor feature, the attacker can redirect git operations to write files outside the intended sandboxed workspace, for example overwriting a shell startup file like .zshenv. That overwritten file then runs attacker code the next time a shell starts, escaping the sandbox restrictions meant to contain the agent.

## Why it matters

An attacker can achieve code execution outside the AI coding agent's sandbox on the developer's machine, using nothing more than a repository the agent is asked to work with plus hidden prompt injection instructions.

## What you can do

- Review any repository before letting an AI coding agent clone or operate on it, especially ones from untrusted sources.
- Audit shell startup files (.zshenv, .bashrc, .profile) for unexpected changes after using AI coding agents on external repositories.
- Restrict or monitor 'git worktree add' commands with paths containing '.git' as a component; no legitimate workflow needs this.
- Keep the coding agent and git updated to versions that reject '.git'-named worktrees and patch the underlying CVE.

## Known benign look-alikes

- A 'git worktree add' command followed elsewhere in the same line by an unrelated file named with a .git-prefixed extension, such as .gitignore or .gitattributes -- excluded because the pattern requires .git to be immediately followed by whitespace, end of string, or a quote, not additional letters
- A bare-repository path that happens to end in .git as a suffix of a longer name, e.g. 'git worktree add /srv/repos/myproject.git feature-branch' -- excluded because the pattern requires .git to be preceded by a path separator or whitespace, not by another word character
- Documentation or an advisory discussing the .git worktree-naming technique in prose without an actual 'git worktree add' command being issued

## References

- https://agentthreatrule.org/en/rules/ATR-2026-02302
- https://github.com/anthropics/claude-code/security/advisories/GHSA-7835-87q9-rgvv
- https://nvd.nist.gov/vuln/detail/CVE-2026-55607

---
Source: https://www.netzilo.com/threats/atr-git-worktree-created-with-reserved-name-git-directory-confus