[imglorp]

This is exactly why Unix PATH (and offspring) does not contain "." by default. If you unpack an untrusted archive and run "ls" you could get popped.

Agents should be no different.

[nickelpro]

They aren't. This is a Windows quirk. Most IDE extensions which interface with git (or any other CLI program) from the CWD are "vulnerable" to the same attack.

This is why the upstream didn't take it seriously, this has been known for literal decades.