AI Coding Agent Spawns Git Checkout of Hash-Shaped Ref (Plugin4Shell)

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•2

Detects instances where AI-assisted coding tools or command-line wrappers (e.g., Claude, Copilot, Gemini) execute Git commands (clone, checkout, fetch) involving a commit hash. This behavior may indicate automated or AI-assisted code retrieval and manipulation, which could be part of an adversary's workflow for reconnaissance or downloading malicious code repositories.