How to protect .git, when I let coding agent work on repo in VM?

I use a coding agent in a VM. I'd like to mount a repo and let the agent do whatever it needs to do in the VM to finish a set of tasks. It has sudo, it can install things, there's nothing to steal, all the secrets are on the host. Let's assume to narrow the scope of the question that I read all the