I explicitly forbid Claude to make any changes to Git state in my global CLAUDE.md, but every so often if I let it perform a task in Auto mode, after it finishes it will remorsefully confess to having used git checkout to test a change. I suppose that its RLHF training has taught it that asking forgiveness later is sometimes a useful workaround for annoying restrictions.