AI Coding Agent Git Checkout Resolves to Ambiguous/Untrusted Ref Bypassing Pin

Ibrahim Saud@tektrix

•updated 21 days ago•0•0•5

This rule detects potentially unauthorized or suspicious repository interactions by monitoring 'git' commands executed by common AI-assisted coding tools or command-line developer utilities. It flags occurrences where a checkout operation occurs without accompanying standard git history or status checks, which may indicate automated exfiltration or lateral movement attempt within a developer environment.