AI Coding Agent Plugin Checkout SHA Mismatch (Plugin4Shell)

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•2

Detects instances where AI coding assistants (such as Claude, Copilot, or Gemini) are used as parent processes to execute specific git commands, including 'git rev-parse HEAD' or 'git checkout'. This can indicate automated or adversary-driven repository interaction initiated by an AI tool, potentially for source code theft, reconnaissance, or malicious automation.