When an LLM in an autonomous loop decides it's time to report back to you, it essentially needs to "commit" its actions. To an agent, making a Git commit and sending a final response to a human are almost the exact same action. The only difference is where the output goes.
By asking the model to use Git just once, you link "git commit" with its natural urge to reply. The agent locks into this trajectory. If you later try to forbid it from committing, it conceptually feels to the LLM like you are forbidding it to answer you altogether, which is something it simply cannot do.
(Not to mention, adding "do not git commit" to your prompt just triggers the pink elephant effect, keeping those exact tokens active in the context window).
You can easily test this overlap yourself. Try manually injecting a fake command like "/commit" into a message in your chat history. If you do, you'll see models like Gemini 3 Flash start mechanically appending "/commit" at the very end of every single response.
This has been our empirical experience from observing agent behavior. Have you guys run into similar trajectory locks? What do you think?