buildOne report1 publisher A static denylist stopped one more prompt injection than no protection in a coding-agent study
Bouras, Dai and Mechtaev found a static denylist let 46 of 75 prompt injections execute in a coding agent, against 3 under preflight-scoped capabilities. A same-day Google report of malware stealing OIDC tokens from GitHub Actions runners puts the outer limit on an agent in the CI job's permissions.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence50
Google's threat intelligence group logged that case in the second quarter of 2026, in the same report that counts distillation runs of more than 100 million prompts against its own generation models. Both started with compromised accounts.
Reality
- Evidence58
- Adoption62
- Hype gap+15
- Incentives72
- Confidence60
Mandiant's testers talked an internal AI assistant into pushing private repos to their own GitHub
Mandiant's report describes an assistant that had permission to clone internal repositories and an approved domain to push them to, and an accounting agent whose runaway loop billed about $50,000 in under an hour.
Reality
- Evidence45
- Adoption30
- Hype gap+20
- Incentives70
- Confidence50
Dustmaker lifts GitHub Actions tokens so its packages clear AI coding trust checks
Google Threat Intelligence Group's September 8 report puts a financially motivated actor, UNC6780, inside PyPI, npm and Docker Hub, publishing under stolen maintainer automation and reselling the AI tool credentials it collects afterwards.
Reality
- Evidence54
- Adoption45
- Hype gap+22
- Incentives64
- Confidence56
Google traces a six-hour credential harvest to a coding chatbot running markdown playbooks
A human broke in and assembled the framework, and after that the scanning, the retries and the address rotation ran on their own out of the victim's own IPs. That middle stretch is what response clocks have to survive.
Reality
- Evidence55
- Adoption60
- Hype gap+18
- Incentives70
- Confidence55