{
  "id": 7098289,
  "title": "Repository Agent-Security Gap Study — v2h baseline",
  "url": "https://urgent.news/2026/09/13/repository-agent-security-gap-study-v2h-baseline",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-13T11:16:09.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/jackymencz/repository-agent-security-gap-study-v2h-baseline-52f5"
  },
  "original_language": "en",
  "account": "A study has examined how different types of malicious content in repository files are detected by various scanning tools. The research focused on agent-directed manipulation in repository content and compared the effectiveness of an agent-facing detector (Sentinel InjectionGate) with current repository scanners such as secret detection and SAST (static application security testing).\n\nThe study used a baseline dataset consisting of 192 files, including 118 synthetic agent-directed payloads and 72 clean controls. The agent-facing detector, Sentinel InjectionGate, was able to flag all 118 agent-directed payloads, as well as 13 additional types of malicious content that are not considered agent-directed, bringing the total detection rate to 85%.\n\nIn contrast, the secret detection tool gitleaks correctly identified the single planted secret but missed the planted eval/0.0.0.0 file. The SAST tool semgrep detected one of the planted secrets and four code vulnerabilities, but again, missed the other agent-directed payloads.\n\nThe study also found that Sentinel InjectionGate was able to sanitize the prompt for 43 out of the 118 hostile files, effectively neutralizing the malicious code. However, 20 of the hostile files still reached the large language model (LLM) without being sanitized, indicating that there is still a risk of the malicious content being executed by the LLM.\n\nOverall, the study highlights the limitations of current repository scanners in detecting agent-directed manipulation and demonstrates the effectiveness of Sentinel InjectionGate in identifying and mitigating these threats.",
  "summary": ".362Z. Harness: /home/ubuntu/hazmat/harness/bench.js (one run, same files, same snapshots, same ground truth for every scanner). Raw rows: bench-v2h.json / bench-v2h.csv . Question. Which classes of agent-directed manipulation in repository content does an agent-facing detector (Sentinel InjectionGate) flag, which do…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}