Pi loads project-local configuration and resources from a repository's `.pi` directory without requiring user trust. This includes project-local extensions, which are executable TypeScript or JavaScript modules loaded directly into the Pi process. An attacker controlling a repository can place malicious Pi-specific resources within it; if a user starts Pi from that working tree, the extension code executes with the same privileges as the local Pi process. The affected component is the project resource loading path, which previously initialized `.pi/settings.json`, project package-managed resources, and project instruction files during session initialization before a trust boundary was established. Because extensions are not sandboxed, they can register commands, tools, and event handlers, allowing access to files, environment variables, credentials, the network, and local tools available to the user.