What happened
Vibe invokes git at session start and during context collection while honouring repository-level git configuration and executable lookup. On Windows it looks for git.exe in the repository root before the trust prompt; elsewhere it runs repo-configured git clean/process-filter drivers and, in older versions, an attacker-set gpg.program combined with log.showSignature on a signed commit. A malicious repository therefore causes arbitrary command execution as the Vibe user on open.
Why it matters
AI coding agents are invoked on external, untrusted repositories. This class shows that simply opening a repository in an agent like Vibe — even before any trust prompt — can execute attacker code, and the agent then runs with the developer's credentials and model API keys.
Attack vector
Opening a crafted repository causes Vibe's SessionLogger/ProjectContextProvider to run a git.exe planted in the repo root before any trust prompt (Windows), or to execute repository-configured git clean/process-filter drivers or a gpg.program during project-context collection. These are classic VCS-config-driven code execution vectors that fire as the AI coding agent analyses the project.
Affected systems
Mistral Vibe < 2.25.5 (Windows untrusted search path); < 2.25.7 (git clean/process-filter); < 3.0.3 (gpg.program)
Mitigation
Upgrade Mistral Vibe to >=2.25.5 (Windows), >=2.25.7, and >=3.0.3 respectively; see the changelog and v2.25.5/v3.0.3 release tags. Treat repositories opened in Vibe as untrusted input.