What Did the Agent Just Push? Auditing Git for AI Agents
The article explores challenges in auditing Git repositories when AI agents make commits and pushes, discussing techniques to track, review, and verify agent-driven changes for security and accountability in automated development workflows.
Background
AI coding agents (like Cursor, Copilot, or Claude-powered tools) can write and commit code autonomously. Humans often merge those commits without reviewing every line, creating a blind spot. This article proposes a lightweight Git audit system: when an agent pushes a commit, a separate agent or CI pipeline reviews the diff for suspicious patterns (e.g., leaking secrets, deleting tests, disabling checks). The author builds a proof-of-concept that runs on every push and alerts the human if something looks off. The key problem is that full manual review defeats the purpose of using an agent, but zero review is dangerous. The proposed middle ground is automated, agent-driven code review of agent-written code.