AI Coding Agent Background Plugin Auto-Update via git fetch/pull

Ibrahim Saud@tektrix

•updated 21 days ago•0•0•4

Detects the execution of git-related operations (fetch, pull, clone) as child processes of common AI coding agent binaries. This pattern is indicative of potential unattended or malicious background plugin auto-updates, which could be leveraged for 'Plugin4Shell' style zero-click plugin distribution attacks.