July 30, 2026
Your side workspace has side quests
Git worktrees are not an isolation boundary for coding agents
That “separate” coding workspace may still be rummaging through your main project
TLDR: The article says Git worktrees aren’t a real safety wall for AI coding helpers, because they still share important project controls behind the scenes. Commenters split between “that’s dangerously misleading” and “nobody promised security here,” with plenty of gripes about convenience, rebuild pain, and surprise gotchas.
The big mood in the comments is somewhere between "well, that’s unsettling" and "okay, but this is what worktrees were always for". The article’s warning is simple in plain English: if you give an AI coding helper its own side workspace inside the same Git project, it may still be able to mess with the shared backstage area — including commit hooks, settings, and even another workspace’s saved changes. Translation for non-Git people: your “separate room” may actually share the same closet, keys, and alarm system. Cue the community side-eye.
One camp basically said, stop calling this isolation at all. As alchaplinsky put it, worktrees are the “obvious pick” because they’re fast and cheap — until you end up “debugging git” instead of your app. That line landed because it captures the real fear: not dramatic movie-hacker stuff, just boring, sneaky surprises that waste your entire afternoon. Another crowd pushed back hard. _def shrugged that people don’t really use this feature for security anyway; they use it for parallel workstreams, meaning multiple tasks at once. In other words: this isn’t betrayal, you just expected too much.
And then came the practical grumbling. One commenter complained the real pain is recompiling everything from scratch and losing ignored files every time — the classic developer version of moving apartments and realizing your charger is gone. Others proposed grown-up fixes like better Git design or simply putting stricter limits on what coding agents are allowed to do. The drama here isn’t just “can the bot be naughty?” It’s the comment-section cage match over whether the tool is flawed, the label is misleading, or users just need to stop treating a convenience feature like a security fence.
Key Points
- •The article says linked Git worktrees share a common `.git` directory, so they do not form a true isolation boundary for coding agents.
- •Per-worktree state is limited to items such as the working directory, `HEAD`, the index, and some rebase or bisect files, while refs, config, stash, hooks, and objects remain shared.
- •The article demonstrates that a hook installed from inside a worktree into the shared hooks directory can run later on the host when the user performs a commit.
- •It also demonstrates that changing Git config from within a worktree modifies the parent repository’s shared configuration, including commit author identity.
- •The article shows that `refs/stash` is shared across worktrees, allowing one worktree to access another worktree’s stash state.