Model behavior: branch created with 'checkout -b feature origin/dev' silently tracks dev — user's next 'git push' bypassed PR review

What happened

While working in a private repository, Claude (Claude Code CLI) was asked to create a new work branch from the shared dev branch. It ran:

git checkout -b feature-branch origin/dev

This silently set the new local branch's upstream to origin/dev. When the user later ran a plain git push themselves, git pushed the feature commits directly into the shared dev branch — no pull request, no review. The work landed on dev unreviewed, and this is effectively unrecoverable without a force-push.

The failure is invisible at creation time: the only signal is one line of git checkout output ("set up to track 'origin/dev'"), and the consequence only materializes later, in a command the user runs.

Why this is worth hardening in the product

• checkout -b <new> <shared-remote-ref> is the most natural way to express "branch off dev", and models produce it readily. The tracking side effect + certain push.default configurations turn it into a review-bypass footgun.
• The blast radius is a shared branch receiving unreviewed commits — one of the costlier classes of agent-adjacent git mistakes, and one the user cannot easily undo.
• It composes badly with agent workflows: the agent creates the branch early in a session; the push happens much later (often by the human), far from the decision that caused it.

Suggested mitigation

Consider adding to Claude Code's git guidance (system prompt / CLAUDE.md defaults) an instruction along the lines of: when creating a branch from a shared branch's remote ref, use --no-track (or immediately git branch --unset-upstream), so a later plain git push can never target the shared branch; set the upstream explicitly on first push (git push -u origin <name>). A post-checkout -b check that the new branch does not track a different-named remote ref would also catch it deterministically.

Environment

• Claude Code CLI, model claude-fable-5
• Reported at the user's explicit request after the incident.

🤖 Generated with Claude Code