Commit-rewriter 0.1: The Agent That Rewrites Your Audit Trail

A September Release That Touches Git History

On September 14, 2026, Simon Willison released commit-rewriter 0.1^[1], a Python web app designed to rewrite the commit messages in a repository. The author built it to clean up commits in Datasette's security releases, which were full of artifacts left by a coding agent and references to tickets in a private repository.

The tool starts with a single command: uvx commit-rewriter path/to/repo. You can omit the path when your shell is already inside the project directory.

Upon confirming the changes, the tool creates a dated branch of the current state, allowing you to roll back. It then rewrites every commit from the first one you touched to the most recent. That second sentence describes the attack surface better than any external analysis.

The Mechanism: From Shell to Security Metadata

Git history is two things at once: an engineering tool and an audit artifact. GPG signatures, timestamps, author, commit parent hash, incident reconstruction starts from those fields.

Rewriting messages changes the content of the affected commits. Hashes are recalculated in cascade up to HEAD, and signatures applied before the rewrite lose their validity.

A coding agent with shell access invokes that command like any other binary. What's missing is an architectural circuit breaker between agent execution and audit storage mutation. The CLI accepts input, the local repo changes state, and the trace becomes less reliable than before.

The operational cost remains minimal: one process, zero special privileges, zero access to the primary repository.

The Root Condition: Audit and Agent in the Same Space

The root condition is easy to state and uncomfortable to fix: the artifact that documents the agent's work resides in the same filesystem where the agent writes.

In mature architectures this separation already exists. Application logs end up on an external, append-only collector with retention outside the control of the process generating them. Local git history lives alongside code and accepts rewrites by design choice.

Self-invocation enabled in the absence of execution boundaries transforms that design into a governance problem. A single command is enough to make security metadata contestable. The system an agent can reach is the system an agent can alter.

When investigating an incident, investigators seek answers to three questions: who wrote that line, when, and with what approval. A mass rewrite removes evidentiary weight from all three.

What Works in the Tool's Favor

Fairness demands noting what this release avoids. The dated branch created before the rewrite makes the operation reversible, as long as that branch stays on disk and gets pushed to a remote.

There is no assigned CVE. There is no public evidence of exploitation. There is no remote vector either: whoever runs the command already has local access to the repo.

The version number declares the state honestly: 0.1 means available, far from production-ready. The use described by the author is legitimate and common in teams releasing security fixes from private repositories. The architectural problem belongs to the category of tools rather than this specific project.

Why the September 2026 Context Changes the Calculation

A local attack surface matters when reliable ways exist to reach the machine. The current month offers two useful reminders.

CISA added five actively exploited vulnerabilities to its KEV catalog, as reported by The Hacker News^[2]. Attackers work on known flaws with patching windows measured in days.

On the client side, a flaw in a Tencent app was used to deliver GrayRabbit malware, according to BleepingComputer^[3]. The delivery channel was trusted software, installed by the user themselves. A developer's workstation hosts dozens of similar channels.

That same machine hosts the coding agent, its shell, signing keys, and the repositories you use to build releases.

Three Questions for Enterprise AI Teams

The security posture of AI systems lags two or three years behind the maturity of the infrastructure hosting them. The useful questions remain operational and have binary answers.

1. Does the coding agent have its own identity, with named logs and immediate revocation?
2. Is git history from critical repositories replicated to append-only storage outside the workstation?
3. Is there an allowlist of commands the agent can execute, with everything else blocked by default?

Many enterprises run agents in production and few treat them as formal identities. A credential shared between human and agent renders the log useless: the actual author of the rewrite remains ambiguous forever.

A negative answer to any of the three indicates an implicitly accepted risk. Implicit risks surface after the incident, during fact reconstruction, when the cost of remediation multiplies.

Decisions for the Next Planning Cycle

For the CTO, the review concerns the development stack rather than the model vendor. The perimeter to redesign is the workstation: sandbox for agent runtime, command allowlist, signed repository mirror on separate infrastructure.

For the Head of Engineering, the choice is concrete: run the agent inside an ephemeral container and treat every git write as a privileged operation requiring explicit approval.

For the CFO, the sign of the calculation changes. Investment in development environment isolation becomes less risky than the alternative, a forensic reconstruction conducted on a trace that an adversary can dispute.

For the procurement committee, the clause to renegotiate concerns default permissions of agentic tools. Whoever supplies the agent must declare which commands are executed, with what identity, and with what vendor-side logging.

Trap or Competitive Advantage

This architecture is a trap as long as git history remains the only proof of work performed. It becomes a competitive advantage when the organization treats the audit trace as an external system, replicated and signed at every push.

commit-rewriter 0.1 does exactly what it promises and declares it transparently. The technical debt sits upstream in the decision to give an agent a full shell on a machine that holds compliance artifacts.

The category of incident the industry catalogs as AI coding agent security breach almost always starts like this: a useful tool, overly broad permission, a missing boundary. The material to close that boundary already exists, and the next planning cycle is the right time to use it.