Git checkout of 40-hex SHA spawned by AI coding agent (Plugin4Shell)

Ibrahim Saud@tektrix

•updated 21 days ago•0•0•0

Detects instances where AI-assisted coding tools (Claude, GitHub Copilot, Codex) spawn the git process to perform a specific 'checkout' command followed by a full commit hash. This behavior may indicate an automated or malicious attempt to manipulate repository states, inject code, or perform unauthorized checkout operations via an AI-assisted development workflow.