Git worktrees don't isolate AI coding agents, despite the hype

Most tools that run coding agents in parallel give each one its own git worktree, marketed as cheap isolation. In practice, worktrees share refs, config, stash, and hooks with the main repository — only the working directory, HEAD, and index are truly per-worktree. The author demonstrates this with reproducible command sequences on git 2.50.1: a hook written from inside a worktree executes on the host the next time you commit in your real repo; a plain git config call from a worktree silently rewrites the author email on your own commits; and because there's a single shared refs/stash, one agent's stashed work can pop into a sibling worktree that never asked for it.

These aren't bugs — they follow directly from how worktrees are built: .git inside a linked worktree is just a file pointing back at one shared .git directory. The two commonly suggested mitigations, extensions.worktreeConfig and core.hooksPath, don't hold up either, since both are themselves set via the shared config that any worktree can overwrite.

The same gap breaks container-based isolation strategies: handing a container a linked worktree means mounting the parent's actual .git, so a writable hooks directory on the host side runs on the host regardless of the container boundary. The piece also corrects an earlier claim that proper isolation (a full clone) is expensive — benchmarked, it costs the same as a worktree, undercutting the entire near-zero-cost pitch.