AI Coding Agent Git Checkout SHA Verification Failure

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•1

Detects an AI coding assistant (e.g., Claude, Copilot, Gemini CLI) attempting to checkout a Git repository and subsequently failing a manual verification check (git rev-parse HEAD) against an expected pinned commit hash. This behavior is indicative of a Plugin4Shell-style supply chain attack attempt, where an adversary tries to inject malicious code into a repository that the AI agent is instructed to use.